CVE-2025-39993

A use-after-free flaw exists in the Linux kernel’s media/rc subsystem. When the device is disconnected via imon_disconnect(), the driver may unconditionally release a usb_device reference (via usb_put_dev) even while other operations (such as vfd_write, send_packet, display_open, lcd_write) are still in progress. Because the pointers usbdev_intf0/usbdev_intf1 are not properly protected by a users-counter or locking, this situation can lead to a use-after-free of the usb_device pointer and therefore memory corruption or kernel stability issues

This vulnerability is rated Moderate severity because exploitation requires local access, an attached SoundGraph iMON device, and winning a race condition during device disconnect. In typical Red Hat Enterprise Linux server environments, consumer infrared and display hardware is not present, substantially reducing exposure. Although successful exploitation could trigger kernel memory corruption or cause a system crash, the flaw cannot be triggered remotely and relies on uncommon hardware interactions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.