The Linux kernel's media tuner driver (xc5000) contained a use-after-free vulnerability in the xc5000_release() function. The issue arose because cancel_delayed_work() does not guarantee that a delayed work item (timer_sleep) has fully completed before the memory (xc5000_priv) is freed. This could cause the delayed work callback to access freed memory, leading to use-after-free conditions. The fix replaces cancel_delayed_work() with cancel_delayed_work_sync(), ensuring the delayed work is fully canceled before freeing memory. The fix is safe from deadlocks as xc5000_release() runs in process context without holding locks needed by the delayed work. This vulnerability was discovered through static analysis.

Successful exploitation of this vulnerability could lead to use-after-free conditions causing memory corruption, potentially resulting in privilege escalation, denial of service, or arbitrary code execution within the kernel context. The CVSS vector indicates local attack vector with low complexity, requiring limited privileges and user interaction, and impacts confidentiality, integrity, and availability at a high level.

A fix is available that replaces cancel_delayed_work() with cancel_delayed_work_sync() in the xc5000_release() function to properly cancel delayed work before freeing memory. Users should apply the official Linux kernel patches that address this issue when they become available. Patch status is not yet confirmed in the provided data; check the vendor advisory for current remediation guidance.