PT-2025-38566 · Linux+2 · Linux Kernel+2

Published 2025-04-16 · Updated 2026-05-26 · CVE-2025-39859

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel contains a use-after-free issue within the ptp ocp watchdog function. The ptp ocp detach() function only shuts down the watchdog timer if it is pending. If the timer handler is already running, timer delete sync() is not called, leading to a race condition where the device link containing the ptp ocp is deallocated while the timer handler is still accessing it. This results in a use-after-free condition.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

AZL-67569

BDU:2025-13685

CVE-2025-39859

ECHO-0715-D1D1-1984

OPENSUSE-SU-2025:20172-1

SUSE-SU-2025:4393-1

SUSE-SU-2025:4422-1

SUSE-SU-2025:4505-1

SUSE-SU-2025:4516-1

SUSE-SU-2025:4517-1

SUSE-SU-2025:4521-1

SUSE-SU-2026:20012-1

SUSE-SU-2026:20015-1

SUSE-SU-2026:20021-1

SUSE-SU-2026:20039-1

SUSE-SU-2026:20059-1

SUSE-SU-2026:20473-1

SUSE-SU-2026:20496-1

Affected Products

Astra Linux

Debian

Linux Kernel

References · 307

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/39xxx/CVE-2025-39859.json · Exploit
• https://osv.dev/vulnerability/AZL-67569 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:20172-1 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-13-CVE-2025-39859 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:20012-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-39859 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:4516-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:20473-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-39859 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:20015-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-39859 · Vendor Advisory
• https://git.kernel.org/stable/c/8bf935cf789872350b04c1a6468b0a509f67afb2 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:4422-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-39859 · Security Note
• https://git.kernel.org/stable/c/f10d3c7267ac7387a5129d5506c3c5f2460cfd9b · Patch