Search: CVE-2025-39994

A use-after-free vulnerability in the Linux kernel's media tuner driver (xc5000) was fixed by replacing cancel_delayed_work() with cancel_delayed_work_sync() in the xc5000_release function. This change ensures that the delayed work item timer_sleep is fully canceled before the associated memory is freed, preventing potential dereferencing of freed memory. The issue was identified through static analysis and affects certain linux-aws kernel versions prior to specified fixed releases.