CVE-2025-39827: net: rose: include node references in rose_neigh refcount
In the Linux kernel, the following vulnerability has been resolved:
net: rose: include node references in roseneigh refcount
Current implementation maintains two separate reference counting mechanisms: the 'count' field in struct roseneigh tracks references from rosenode structures, while the 'use' field (now refcountt) tracks references from rosesock.
This patch merges these two reference counting systems using 'use' field for proper reference management. Specifically, this patch adds incrementing and decrementing of roseneigh->use when roseneigh->count is incremented or decremented.
This patch also modifies rosertfree(), rosertdevicedown() and roseclearroute() to properly release references to roseneigh objects before freeing a rosenode through roseremovenode().
These changes ensure roseneigh structures are properly freed only when all references, including those from rosenode structures, are released. As a result, this resolves a slab-use-after-free issue reported by Syzbot.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-39827?
CVE-2025-39827 has a medium severity rating due to its potential impact on the Linux kernel.
How do I fix CVE-2025-39827?
To fix CVE-2025-39827, ensure you update your Linux kernel to the latest patched version provided by your distribution.
Who is affected by CVE-2025-39827?
CVE-2025-39827 affects all versions of the Linux kernel that are running the vulnerable rose_neigh implementation.
What components are involved in CVE-2025-39827?
CVE-2025-39827 involves the networking subsystem of the Linux kernel, specifically the rose protocol.
Is CVE-2025-39827 being actively exploited?
As of current information, there are no known active exploits for CVE-2025-39827.