CVE-2025-21711: net/rose: prevent integer overflows in rose_setsockopt()
First published: Thu Feb 27 2025(Updated: )
In the Linux kernel, the following vulnerability has been resolved: net/rose: prevent integer overflows in rose_setsockopt() In case of possible unpredictably large arguments passed to rose_setsockopt() and multiplied by extra values on top of that, integer overflows may occur. Do the safest minimum and fix these issues by checking the contents of 'opt' and returning -EINVAL if they are too large. Also, switch to unsigned int and remove useless check for negative 'opt' in ROSE_IDLE case.
Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux Kernel | ||
| Linux Kernel | >=2.6.12<6.1.129 | |
| Linux Kernel | >=6.2<6.6.76 | |
| Linux Kernel | >=6.7<6.12.13 | |
| Linux Kernel | >=6.13<6.13.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://git.kernel.org/stable/c/352daa50946c3bbb662432e8daf54d6760796589
- https://git.kernel.org/stable/c/9bdee49ad6bbd26ab5e13cc6731e54fb1b6c1dca
- https://git.kernel.org/stable/c/d08f4074f9c69f7e95502587eb1b258a965ba7f0
- https://git.kernel.org/stable/c/d640627663bfe7d8963c7615316d7d4ef60f3b0b
- https://git.kernel.org/stable/c/e5338930a29d0ab2a5af402f5f664aeba0d1a676
- https://git.kernel.org/stable/c/4bdd449977e2364a53d0b2a5427e71beb1cd702d
- https://git.kernel.org/stable/c/b8583b54455cbec2fc038fa32b6700890b369815
Frequently Asked Questions
What is the severity of CVE-2025-21711?
CVE-2025-21711 has a moderate severity level due to potential integer overflows in the Linux kernel's rose_setsockopt() function.
How do I fix CVE-2025-21711?
To fix CVE-2025-21711, users should update their Linux kernel to the latest available version that includes the security patch.
What are the consequences of CVE-2025-21711?
Exploiting CVE-2025-21711 can lead to system instability or crashes due to integer overflow vulnerabilities.
Which versions of the Linux kernel are affected by CVE-2025-21711?
CVE-2025-21711 affects multiple versions of the Linux kernel, specifically from 2.6.12 to 6.1.129, 6.2 to 6.6.76, 6.7 to 6.12.13, and 6.13 to 6.13.2.
What components of the Linux kernel are impacted by CVE-2025-21711?
The CVE-2025-21711 vulnerability specifically impacts the net/rose component of the Linux kernel.
- agent/type
- agent/title
- agent/author
- agent/source
- agent/description
- agent/first-publish-date
- agent/remedy
- agent/severity
- agent/softwarecombine
- agent/event
- agent/weakness
- agent/references
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/guess-ai
- agent/software-canonical-lookup-request
- vendor/linux
- canonical/linux kernel
- version/linux kernel/2.6.12
- version/linux kernel/6.2
- version/linux kernel/6.7
- version/linux kernel/6.13