CVE-2025-39996

A use-after-free vulnerability was discovered in the Linux kernel’s b2c2 FlexCop PCI media device driver. The flaw exists in the flexcop_pci_remove() function where cancel_delayed_work() is used to cancel a pending work item (irq_check_work). Because cancel_delayed_work() does not guarantee that a running delayed work item has completed before returning, the driver may free the underlying flexcop_device structure while irq_check_work is still executing. This creates a race condition leading to a use-after-free, which can result in kernel memory being accessed after it has been freed.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the flexcop-pci kernel module from loading. Create a file named /etc/modprobe.d/disable-flexcop-pci.conf with the following content:

blacklist flexcop-pci

Then, regenerate the initramfs and reboot the system for the changes to take effect. For Red Hat Enterprise Linux 7 and 8, use dracut -f. This may impact functionality that relies on the B2C2 FlexCop PCI device. A system reboot is required for the changes to take effect.