CVE-2025-39827: net: rose: include node references in rose_neigh refcount

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-09-16 · updated 2026-10-19

Description

In the Linux kernel, the following vulnerability has been resolved: net: rose: include node references in rose_neigh refcount Current implementation maintains two separate reference counting mechanisms: the 'count' field in struct rose_neigh tracks references from rose_node structures, while the 'use' field (now refcount_t) tracks references from rose_sock. This patch merges these two reference counting systems using 'use' field for proper reference management. Specifically, this patch adds incrementing and decrementing of rose_neigh->use when rose_neigh->count is incremented or decremented. This patch also modifies rose_rt_free(), rose_rt_device_down() and rose_clear_route() to properly release references to rose_neigh objects before freeing a rose_node through rose_remove_node(). These changes ensure rose_neigh structures are properly freed only when all references, including those from rose_node structures, are released. As a result, this resolves a slab-use-after-free issue reported by Syzbot.

Affected products

Debian Linux: 11.0
Linux kernel: from 2.6.12.1 before 6.1.150; from 6.2 before 6.6.104; from 6.7 before 6.12.45; from 6.13 before 6.16.5; 2.6.12, 2.6.12-rc2, 2.6.12-rc3, 2.6.12-rc4, 2.6.12-rc5, 6.17-rc1 (+2) — fixed in 6.1.150, 6.12.45, 6.16.5, 6.6.104

How to fix

Upgrade to a fixed version: Linux kernel 6.1.150, 6.12.45, 6.16.5, 6.6.104. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-39827 or the next vulnerability affects your stack