CVE-2025-39994

A use-after-free flaw was identified in the Linux kernel’s media tuner (xc5000) driver. In the vulnerable code path, xc5000_release() calls cancel_delayed_work() to cancel a pending delayed work item (timer_sleep) without guaranteeing that the work handler has fully completed. Under a race condition, the underlying xc5000_priv structure may be freed while the delayed work item is still active, potentially resulting in a use-after-free when the work item subsequently dereferences the freed memory.

This vulnerability is rated as Moderate severity for Red Hat because successful exploitation requires local access with privileged hardware interactions, uncommon physical tuner hardware, and precise timing to trigger a race condition during device tear-down. Typical enterprise server and cloud deployments do not use analog or digital TV tuner devices, significantly restricting real-world exposure. Consequently, the flaw primarily poses a local denial of service or potential system instability on systems where this specific media tuner peripheral is attached and active.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the xc5000 kernel module from loading. Create a file /etc/modprobe.d/blacklist-xc5000.conf with blacklist xc5000. Regenerate the initramfs using dracut -f -v and reboot the system. This may impact functionality if xc5000 tuner hardware is in use.