CVE-2025-39978: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-39978 is a vulnerability discovered in the Linux kernel, specifically in the octeontx2-pf driver component. The vulnerability was published on October 15, 2025, and involves a potential use-after-free issue in the otx2_tc_add_flow() function (NVD).

The vulnerability stems from a code sequence where kfree_rcu(new_node, rcu) is called followed by dereferencing 'new_node' on the next line. The issue is further complicated by a mutex being taken two lines later in a non-RCU safe region. This creates a potential use-after-free condition in the kernel's memory management (NVD).

The vulnerability affects multiple versions of the Linux kernel across various distributions. Ubuntu has marked this as a medium priority issue, with several kernel versions being vulnerable including those in Ubuntu 24.04 LTS noble and 22.04 LTS jammy releases (Ubuntu).

Some distributions have already implemented fixes for this vulnerability. Ubuntu has released a fix in version 6.17.0-6.6 for the 25.10 questing release. For other affected versions, updates are being developed and will be released through the standard security update channels (Ubuntu).