cbcvebase.
CVE-2025-39827
published 2025-09-16

CVE-2025-39827: In the Linux kernel, the following vulnerability has been resolved: net: rose: include node references in rose_neigh refcount Current implementation maintains…

medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
In the Linux kernel, the following vulnerability has been resolved: net: rose: include node references in rose_neigh refcount Current implementation maintains two separate reference counting mechanisms: the 'count' field in struct rose_neigh tracks references from rose_node structures, while the 'use' field (now refcount_t) tracks references from rose_sock. This patch merges these two reference counting systems using 'use' field for proper reference management. Specifically, this patch adds incrementing and decrementing of rose_neigh->use when rose_neigh->count is incremented or decremented. This patch also modifies rose_rt_free(), rose_rt_device_down() and rose_clear_route() to properly release references to rose_neigh objects before freeing a rose_node through rose_remove_node(). These changes ensure rose_neigh structures are properly freed only when all references, including those from rose_node structures, are released. As a result, this resolves a slab-use-after-free issue reported by Syzbot.

Affected

22 ranges
VendorProductVersion rangeFixed in
debiandebian_linux
debianlinux< linux 6.1.153-1 (bookworm)linux 6.1.153-1 (bookworm)
debianlinux-6.1< linux 6.1.153-1 (bookworm)linux 6.1.153-1 (bookworm)
linuxlinux
linuxlinux>= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 4cce478c3e82a5fc788d72adb2f4c4e9839976394cce478c3e82a5fc788d72adb2f4c4e983997639
linuxlinux>= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 9c547c8eee9d1cf6e744611d688b9f725cf9a1159c547c8eee9d1cf6e744611d688b9f725cf9a115
linuxlinux>= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < d7563b456ed44151e1a82091d96f60166daea89bd7563b456ed44151e1a82091d96f60166daea89b
linuxlinux>= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 384210cceb1873a4c8218b27ba0745444436b728384210cceb1873a4c8218b27ba0745444436b728
linuxlinux>= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < da9c9c877597170b929a6121a68dcd3dd9a80f45da9c9c877597170b929a6121a68dcd3dd9a80f45
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel>= 0 < 6.1.153-16.1.153-1
linuxlinux_kernel>= 0 < 6.12.48-16.12.48-1
linuxlinux_kernel>= 0 < 6.16.5-16.16.5-1
linuxlinux_kernel>= 0 < 6.8.0-106.1066.8.0-106.106
linuxlinux_kernel>= 2.6.12.1 < 6.1.1506.1.150
linuxlinux_kernel>= 6.13 < 6.16.56.16.5
linuxlinux_kernel>= 6.2 < 6.6.1046.6.104
linuxlinux_kernel>= 6.7 < 6.12.456.12.45
msrcazl3_kernel_6.6.96.2-2_on_azure_linux_3.0
msrccbl2_kernel_5.15.186.1-1_on_cbl_mariner_2.0
ubuntulinux-xilinx

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM