CVE-2025-71086: net: rose: fix invalid array index in rose_kill_by_device()
In the Linux kernel, the following vulnerability has been resolved:
net: rose: fix invalid array index in rosekillbydevice()
rosekillbydevice() collects sockets into a local array[] and then iterates over them to disconnect sockets bound to a device being brought down.
The loop mistakenly indexes array[cnt] instead of array[i]. For cnt < ARRAYSIZE(array), this reads an uninitialized entry; for cnt == ARRAYSIZE(array), it is an out-of-bounds read. Either case can lead to an invalid socket pointer dereference and also leaks references taken via sockhold().
Fix the index to use i.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71086?
CVE-2025-71086 is marked as a medium severity vulnerability affecting the Linux kernel.
How do I fix CVE-2025-71086?
To fix CVE-2025-71086, update the Linux kernel to the latest stable version that includes the patch for this vulnerability.
What impact does CVE-2025-71086 have on my system?
CVE-2025-71086 could potentially allow for disruption in network socket disconnections, possibly affecting application stability.
Which versions of the Linux kernel are affected by CVE-2025-71086?
CVE-2025-71086 affects various versions of the Linux kernel prior to the patch being applied.
How can I confirm if my system is vulnerable to CVE-2025-71086?
You can confirm if your system is vulnerable to CVE-2025-71086 by checking the kernel version and running any recommended security tools.