CVE-2025-39872
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
23/09/2025
Last modified:
24/09/2025
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
hsr: hold rcu and dev lock for hsr_get_port_ndev<br />
<br />
hsr_get_port_ndev calls hsr_for_each_port, which need to hold rcu lock.<br />
On the other hand, before return the port device, we need to hold the<br />
device reference to avoid UaF in the caller function.