Critical Vulnerability in Linux Kernel: mISDN hfcpci Module Timer Initialization Flaw
Summary
CVE-2025-39833: In the Linux kernel, the following vulnerability has been resolved: mISDN: hfcpci: Fix warning when deleting uninitialized timer With CONFIG_DEBUG_OBJECTS_TIMERS unloading hfcpci module leads to the following splat: [ 25... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interactions. It is known for its stability, performance, and flexibility. The kernel supports various modules, including the mISDN framework, which facilitates ISDN (Integrated Services Digital Network) communication. The vulnerability in question affects the hfcpci module within mISDN, leading to potential system instability when the module is unloaded.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the mISDN framework, specifically within the hfcpci module. This issue arises due to the improper initialization of a timer object, which can trigger a warning when the module is unloaded. The warning indicates that the timer object was not properly initialized, leading to potential system crashes or undefined behavior. The vulnerability is linked to the CONFIG_DEBUG_OBJECTS_TIMERS configuration, which, when enabled, exposes this flaw during module unloading. The ramifications include system instability and potential denial of service, as the kernel may fail to handle the uninitialized timer correctly.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid unloading the hfcpci module while the CONFIG_DEBUG_OBJECTS_TIMERS option is enabled. This will prevent the warning and potential instability associated with the uninitialized timer.
Conclusion
The vulnerability in the Linux kernel's mISDN hfcpci module poses significant risks to system stability and security. Users are strongly encouraged to update their kernel to the patched version to mitigate these risks. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves an uninitialized timer in the hfcpci module of the Linux kernel, which can lead to warnings and potential system instability when the module is unloaded.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
The consequences include system crashes, undefined behavior, and potential denial of service due to improper handling of the uninitialized timer.
Yes, a patch is available in version 6.16.5-1 of the Linux kernel. Users are advised to update to this version or later.
If an immediate update is not possible, avoid unloading the hfcpci module while the CONFIG_DEBUG_OBJECTS_TIMERS option is enabled to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
