Use-After-Free Vulnerability in Linux Kernel: Impacting Debian Packages
Summary
DEBIAN-CVE-2025-40003: In the Linux kernel, the following vulnerability has been resolved: net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work The origin code calls cancel_delayed_work() in ocelot_stats_deinit() to cancel the c... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Debian operating system, responsible for managing hardware resources and providing essential services to applications. This vulnerability affects multiple Debian versions (11, 12, 13, and 14) of the Linux package, which is crucial for system stability and performance. The vulnerability arises from improper handling of delayed work items, potentially leading to system instability and security risks.
Vulnerability Detail
In the Linux kernel, a use-after-free vulnerability has been identified in the net: mscc: ocelot module. The issue occurs when cancel_delayed_work() is called in ocelot_stats_deinit() to cancel a cyclic delayed work item. If the work item is currently executing, the cancellation may fail, leading to a scenario where the delayed work item can be rescheduled after the work queue has been destroyed. This can result in warnings and potential system crashes, as the system attempts to queue work on a deallocated work queue, constituting a serious security risk.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can disable the delayed work item by replacing the call to cancel_delayed_work() with disable_delayed_work_sync() in the source code. This ensures that any currently executing work is completed before the work queue is deallocated, preventing the use-after-free scenario.
Conclusion
The use-after-free vulnerability in the Linux kernel poses significant risks to Debian systems. By understanding the nature of this vulnerability and following the recommended steps to update and secure your system, you can mitigate potential threats and maintain system integrity.
See every vulnerability recorded for linux →
FAQ
A use-after-free vulnerability occurs when a program continues to use a memory location after it has been freed, potentially leading to unpredictable behavior, crashes, or security breaches.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file, such as package-lock.json, you can check for vulnerabilities in real-time.
If exploited, this vulnerability could lead to system crashes, unauthorized access, or execution of arbitrary code, compromising the integrity and security of the system.
Yes, a patched version of the Linux package is available. It is advisable to update your system to the latest version to mitigate this vulnerability.
It is recommended to regularly check for updates and apply them promptly to ensure your system is protected against known vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
