CVE-2025-21718: net: rose: fix timer races against user threads
In the Linux kernel, the following vulnerability has been resolved:
net: rose: fix timer races against user threads
Rose timers only acquire the socket spinlock, without checking if the socket is owned by one user thread.
Add a check and rearm the timers if needed.
BUG: KASAN: slab-use-after-free in rosetimerexpiry+0x31d/0x360 net/rose/rosetimer.c:174 Read of size 2 at addr ffff88802f09b82a by task swapper/0/0
CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.13.0-rc5-syzkaller-00172-gd1bf27c4e176 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: <IRQ> dumpstack lib/dumpstack.c:94 [inline] dumpstacklvl+0x241/0x360 lib/dumpstack.c:120 printaddressdescription mm/kasan/report.c:378 [inline] printreport+0x169/0x550 mm/kasan/report.c:489 kasanreport+0x143/0x180 mm/kasan/report.c:602 rosetimerexpiry+0x31d/0x360 net/rose/rosetimer.c:174 calltimerfn+0x187/0x650 kernel/time/timer.c:1793 expiretimers kernel/time/timer.c:1844 [inline] runtimers kernel/time/timer.c:2418 [inline] runtimerbase+0x66a/0x8e0 kernel/time/timer.c:2430 runtimerbase kernel/time/timer.c:2439 [inline] runtimersoftirq+0xb7/0x170 kernel/time/timer.c:2449 handlesoftirqs+0x2d4/0x9b0 kernel/softirq.c:561 dosoftirq kernel/softirq.c:595 [inline] invokesoftirq kernel/softirq.c:435 [inline] irqexitrcu+0xf7/0x220 kernel/softirq.c:662 irqexitrcu+0x9/0x30 kernel/softirq.c:678 instrsysvecapictimerinterrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvecapictimerinterrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049 </IRQ>
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.78.1-3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.15.179.1-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-21718?
CVE-2025-21718 has not yet been assigned a severity rating, but it addresses a critical race condition in the Linux kernel's rose timers.
How do I fix CVE-2025-21718?
To fix CVE-2025-21718, update your Linux kernel to a version that includes the patch addressing the timer races.
What software versions are affected by CVE-2025-21718?
CVE-2025-21718 affects various versions of the Linux kernel between 2.6.12 and up to 6.13.2.
What impact does CVE-2025-21718 have on security?
CVE-2025-21718 could potentially allow local user threads to disrupt timer functionality, creating instability in the system.
Is there a workaround for CVE-2025-21718?
There are no official workarounds for CVE-2025-21718; applying the appropriate kernel update is the recommended solution.