UBUNTU-CVE-2025-39993
In the Linux kernel, the following vulnerability has been resolved: media: rc: fix races with imon_disconnect() Syzbot reports a KASAN issue as below: BUG: KASAN: use-after-free in __create_pipe include/linux/usb.h:1945 [inline] BUG: KASAN: use-after-free in send_packet+0xa2d/0xbc0 drivers/media/rc/imon.c:627 Read of size 4 at addr ffff8880256fb000 by task syz-executor314/4465 CPU: 2 PID: 4465 Comm: syz-executor314 Not tainted 6.0.0-rc1-syzkaller #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:317 [inline] print_report.cold+0x2ba/0x6e9 mm/kasan/report.c:433 kasan_report+0xb1/0x1e0 mm/kasan/report.c:495 __create_pipe include/linux/usb.h:1945 [inline] send_packet+0xa2d/0xbc0 drivers/media/rc/imon.c:627 vfd_write+0x2d9/0x550 drivers/media/rc/imon.c:991 vfs_write+0x2d7/0xdd0 fs/read_write.c:576 ksys_write+0x127/0x250 fs/read_write.c:631 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd The iMON driver improperly releases the usb_device reference in imon_disconnect without coordinating with active users of the device. Specifically, the fields usbdev_intf0 and usbdev_intf1 are not protected by the users counter (ictx->users). During probe, imon_init_intf0 or imon_init_intf1 increments the usb_device reference count depending on the interface. However, during disconnect, usb_put_dev is called unconditionally, regardless of actual usage. As a result, if vfd_write or other operations are still in progress after disconnect, this can lead to a use-after-free of the usb_device pointer. Thread 1 vfd_write Thread 2 imon_disconnect ... if usb_put_dev(ictx->usbdev_intf0) else usb_put_dev(ictx->usbdev_intf1) ... while send_packet if pipe = usb_sndintpipe( ictx->usbdev_intf0) UAF else pipe = usb_sndctrlpipe( ictx->usbdev_intf0, 0) UAF Guard access to usbdev_intf0 and usbdev_intf1 after disconnect by checking ictx->disconnected in all writer paths. Add early return with -ENODEV in send_packet(), vfd_write(), lcd_write() and display_open() if the device is no longer present. Set and read ictx->disconnected under ictx->lock to ensure memory synchronization. Acquire the lock in imon_disconnect() before setting the flag to synchronize with any ongoing operations. Ensure writers exit early and safely after disconnect before the USB core proceeds with cleanup. Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
02 / AFFECTED SOFTWARE
Affected packages
10 explicit affected versions
26 explicit affected versions
67 explicit affected versions
37 explicit affected versions
8 explicit affected versions
7 explicit affected versions
12 explicit affected versions
11 explicit affected versions
1 explicit affected versions
83 explicit affected versions
30 explicit affected versions
86 explicit affected versions
10 explicit affected versions
34 explicit affected versions
81 explicit affected versions
1 explicit affected versions
10 explicit affected versions
7 explicit affected versions
35 explicit affected versions
13 explicit affected versions
11 explicit affected versions
3 explicit affected versions
6 explicit affected versions
45 explicit affected versions
108 explicit affected versions
76 explicit affected versions
50 explicit affected versions
12 explicit affected versions
19 explicit affected versions
6 explicit affected versions
86 explicit affected versions
24 explicit affected versions
71 explicit affected versions
71 explicit affected versions
83 explicit affected versions
77 explicit affected versions
66 explicit affected versions
26 explicit affected versions
78 explicit affected versions
191 explicit affected versions
7 explicit affected versions
75 explicit affected versions
30 explicit affected versions
13 explicit affected versions
78 explicit affected versions
33 explicit affected versions
35 explicit affected versions
38 explicit affected versions
36 explicit affected versions
18 explicit affected versions
33 explicit affected versions
110 explicit affected versions
64 explicit affected versions
35 explicit affected versions
113 explicit affected versions
8 explicit affected versions
13 explicit affected versions
4 explicit affected versions
23 explicit affected versions
115 explicit affected versions
41 explicit affected versions
116 explicit affected versions
1 explicit affected versions
1 explicit affected versions
21 explicit affected versions
9 explicit affected versions
16 explicit affected versions
10 explicit affected versions
7 explicit affected versions
12 explicit affected versions
14 explicit affected versions
10 explicit affected versions
1 explicit affected versions
7 explicit affected versions
9 explicit affected versions
97 explicit affected versions
12 explicit affected versions
99 explicit affected versions
12 explicit affected versions
30 explicit affected versions
114 explicit affected versions
32 explicit affected versions
12 explicit affected versions
5 explicit affected versions
22 explicit affected versions
23 explicit affected versions
10 explicit affected versions
182 explicit affected versions
37 explicit affected versions
8 explicit affected versions
13 explicit affected versions
29 explicit affected versions
3 explicit affected versions
10 explicit affected versions
11 explicit affected versions
53 explicit affected versions
26 explicit affected versions
2 explicit affected versions
13 explicit affected versions
25 explicit affected versions
1 explicit affected versions
29 explicit affected versions
103 explicit affected versions
13 explicit affected versions
11 explicit affected versions
30 explicit affected versions
1 explicit affected versions
94 explicit affected versions
78 explicit affected versions
41 explicit affected versions
33 explicit affected versions
23 explicit affected versions
47 explicit affected versions
10 explicit affected versions
9 explicit affected versions
8 explicit affected versions
108 explicit affected versions
11 explicit affected versions
5 explicit affected versions
12 explicit affected versions
131 explicit affected versions
7 explicit affected versions
12 explicit affected versions
6 explicit affected versions
2 explicit affected versions
4 explicit affected versions
63 explicit affected versions
123 explicit affected versions
79 explicit affected versions
159 explicit affected versions
145 explicit affected versions
10 explicit affected versions
26 explicit affected versions
30 explicit affected versions
1 explicit affected versions
55 explicit affected versions
24 explicit affected versions
124 explicit affected versions
36 explicit affected versions
10 explicit affected versions
13 explicit affected versions
35 explicit affected versions
131 explicit affected versions
71 explicit affected versions
16 explicit affected versions
77 explicit affected versions
39 explicit affected versions
85 explicit affected versions
1 explicit affected versions
7 explicit affected versions
2 explicit affected versions
3 explicit affected versions
51 explicit affected versions
5 explicit affected versions
84 explicit affected versions
18 explicit affected versions
31 explicit affected versions
12 explicit affected versions
64 explicit affected versions
66 explicit affected versions
27 explicit affected versions
52 explicit affected versions
113 explicit affected versions
1 explicit affected versions
1 explicit affected versions
89 explicit affected versions
32 explicit affected versions
8 explicit affected versions
43 explicit affected versions
5 explicit affected versions
8 explicit affected versions
11 explicit affected versions
102 explicit affected versions
13 explicit affected versions
64 explicit affected versions
7 explicit affected versions
8 explicit affected versions
7 explicit affected versions
12 explicit affected versions
8 explicit affected versions
26 explicit affected versions
101 explicit affected versions
8 explicit affected versions
74 explicit affected versions
48 explicit affected versions
44 explicit affected versions
16 explicit affected versions
3 explicit affected versions
13 explicit affected versions
26 explicit affected versions
45 explicit affected versions
37 explicit affected versions
40 explicit affected versions
105 explicit affected versions
14 explicit affected versions
38 explicit affected versions
9 explicit affected versions
5 explicit affected versions
28 explicit affected versions
11 explicit affected versions
2 explicit affected versions
79 explicit affected versions
8 explicit affected versions
91 explicit affected versions
135 explicit affected versions
114 explicit affected versions
4 explicit affected versions
68 explicit affected versions
1 explicit affected versions
1 explicit affected versions
1 explicit affected versions
77 explicit affected versions
68 explicit affected versions
67 explicit affected versions
13 explicit affected versions
43 explicit affected versions
69 explicit affected versions
138 explicit affected versions
111 explicit affected versions
159 explicit affected versions
10 explicit affected versions
14 explicit affected versions
4 explicit affected versions
78 explicit affected versions
2 explicit affected versions
11 explicit affected versions
1 explicit affected versions
61 explicit affected versions
115 explicit affected versions
8 explicit affected versions
28 explicit affected versions
67 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
In the Linux kernel, the following vulnerability has been resolved: media: rc: fix races with imon_disconnect() Syzbot reports a KASAN issue as below: BUG: KASAN: use-after-free in __create_pipe include/linux/usb.h:1945 [inline] BUG: KASAN: use-after-free in send_packet+0xa2d/0xbc0 drivers/media/rc/imon.c:627 Read of size 4 at addr ffff8880256fb000 by task syz-executor314/4465 CPU: 2 PID: 4465 Comm: syz-executor314 Not tainted 6.0.0-rc1-syzkaller #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:317 [inline] print_report.cold+0x2ba/0x6e9 mm/kasan/report.c:433 kasan_report+0xb1/0x1e0 mm/kasan/report.c:495 __create_pipe include/linux/usb.h:1945 [inline] send_packet+0xa2d/0xbc0 drivers/media/rc/imon.c:627 vfd_write+0x2d9/0x550 drivers/media/rc/imon.c:991 vfs_write+0x2d7/0xdd0 fs/read_write.c:576 ksys_write+0x127/0x250 fs/read_write.c:631 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd The iMON driver improperly releases the usb_device reference in imon_disconnect without coordinating with active users of the device. Specifically, the fields usbdev_intf0 and usbdev_intf1 are not protected by the users counter (ictx->users). During probe, imon_init_intf0 or imon_init_intf1 increments the usb_device reference count depending on the interface. However, during disconnect, usb_put_dev is called unconditionally, regardless of actual usage. As a result, if vfd_write or other operations are still in progress after disconnect, this can lead to a use-after-free of the usb_device pointer. Thread 1 vfd_write Thread 2 imon_disconnect ... if usb_put_dev(ictx->usbdev_intf0) else usb_put_dev(ictx->usbdev_intf1) ... while send_packet if pipe = usb_sndintpipe( ictx->usbdev_intf0) UAF else pipe = usb_sndctrlpipe( ictx->usbdev_intf0, 0) UAF Guard access to usbdev_intf0 and usbdev_intf1 after disconnect by checking ictx->disconnected in all writer paths. Add early return with -ENODEV in send_packet(), vfd_write(), lcd_write() and display_open() if the device is no longer present. Set and read ictx->disconnected under ictx->lock to ensure memory synchronization. Acquire the lock in imon_disconnect() before setting the flag to synchronize with any ongoing operations. Ensure writers exit early and safely after disconnect before the USB core proceeds with cleanup. Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
05 / REFERENCES
Further evidence
- https://git.kernel.org/linus/fa0f61cc1d828178aa921475a9b786e7fbb65ccb
- https://git.kernel.org/stable/c/2e7fd93b9cc565b839bc55a6662475718963e156
- https://git.kernel.org/stable/c/71096a6161a25e84acddb89a9d77f138502d26ab
- https://git.kernel.org/stable/c/71da40648741d15b302700b68973fe8b382aef3c
- https://git.kernel.org/stable/c/d9f6ce99624a41c3bcb29a8d7d79b800665229dd
- https://git.kernel.org/stable/c/fa0f61cc1d828178aa921475a9b786e7fbb65ccb
- https://git.kernel.org/stable/c/fd5d3e6b149ec8cce045d86a2b5e3664d6b32ba5
- https://ubuntu.com/security/CVE-2025-39993
- https://ubuntu.com/security/notices/USN-7921-1
- https://ubuntu.com/security/notices/USN-7921-2
- https://ubuntu.com/security/notices/USN-7922-1
- https://ubuntu.com/security/notices/USN-7922-2
- https://ubuntu.com/security/notices/USN-7922-3
- https://ubuntu.com/security/notices/USN-7922-4
- https://ubuntu.com/security/notices/USN-7922-5
- https://ubuntu.com/security/notices/USN-7928-1
- https://ubuntu.com/security/notices/USN-7928-2
- https://ubuntu.com/security/notices/USN-7928-3
- https://ubuntu.com/security/notices/USN-7928-4
- https://ubuntu.com/security/notices/USN-7928-5
- https://ubuntu.com/security/notices/USN-7931-1
- https://ubuntu.com/security/notices/USN-7931-2
- https://ubuntu.com/security/notices/USN-7931-3
- https://ubuntu.com/security/notices/USN-7931-4
- https://ubuntu.com/security/notices/USN-7931-5
- https://ubuntu.com/security/notices/USN-7934-1
- https://ubuntu.com/security/notices/USN-7935-1
- https://ubuntu.com/security/notices/USN-7936-1
- https://ubuntu.com/security/notices/USN-7938-1
- https://ubuntu.com/security/notices/USN-7939-1
- https://ubuntu.com/security/notices/USN-7939-2
- https://ubuntu.com/security/notices/USN-7940-1
- https://ubuntu.com/security/notices/USN-7940-2
- https://ubuntu.com/security/notices/USN-7987-1
- https://ubuntu.com/security/notices/USN-7987-2
- https://ubuntu.com/security/notices/USN-7988-1
- https://ubuntu.com/security/notices/USN-7988-2
- https://ubuntu.com/security/notices/USN-7988-3
- https://ubuntu.com/security/notices/USN-7988-4
- https://ubuntu.com/security/notices/USN-7988-5
- https://www.cve.org/CVERecord?id=CVE-2025-39993