CVE-2025-21718

net: rose: fix timer races against user threads

State: Published
Severity: 7.8 High
Published: Feb 27, 2025
Updated: Oct 15, 2026
Reserved: Dec 29, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

net: rose: fix timer races against user threads

Rose timers only acquire the socket spinlock, without checking if the socket is owned by one user thread.

Add a check and rearm the timers if needed.

BUG: KASAN: slab-use-after-free in rose_timer_expiry+0x31d/0x360 net/rose/rose_timer.c:174 Read of size 2 at addr ffff88802f09b82a by task swapper/0/0

CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.13.0-rc5-syzkaller-00172-gd1bf27c4e176 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x169/0x550 mm/kasan/report.c:489 kasan_report+0x143/0x180 mm/kasan/report.c:602 rose_timer_expiry+0x31d/0x360 net/rose/rose_timer.c:174 call_timer_fn+0x187/0x650 kernel/time/timer.c:1793 expire_timers kernel/time/timer.c:1844 [inline] __run_timers kernel/time/timer.c:2418 [inline] __run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2430 run_timer_base kernel/time/timer.c:2439 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2449 handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:561 __do_softirq kernel/softirq.c:595 [inline] invoke_softirq kernel/softirq.c:435 [inline] __irq_exit_rcu+0xf7/0x220 kernel/softirq.c:662 irq_exit_rcu+0x9/0x30 kernel/softirq.c:678 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049 </IRQ>

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 52f5aff33ca73b2c2fa93f40a3de308012e63cf4Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 0d5bca3be27bfcf8f980f2fed49b6cbb7dafe4a1Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 1409b45d4690308c502c6caf22f01c3c205b4717Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before f55c88e3ca5939a6a8a329024aed8f3d98eea8e4Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 51c128ba038cf1b79d605cbee325919b45ab95a5Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 1992fb261c90e9827cf5dc3115d89bb0853252c9Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 58051a284ac18a3bb815aac6289a679903ddcc3fAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 5de7665e0a0746b5ad7943554b34db8f8614a196Affected
LinuxLinux	2.6.12Affected before 2.6.12Not affected 5.4.291 through 5.4.Not affected 5.10.235 through 5.10.Not affected 5.15.179 through 5.15.Not affected 6.1.129 through 6.1.Not affected 6.6.76 through 6.6.Not affected 6.12.13 through 6.12.Not affected 6.13.2 through 6.13.*Not affected 6.14 and laterNot affected

Product

Versions

LinuxLinux

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 52f5aff33ca73b2c2fa93f40a3de308012e63cf4Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 0d5bca3be27bfcf8f980f2fed49b6cbb7dafe4a1Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 1409b45d4690308c502c6caf22f01c3c205b4717Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before f55c88e3ca5939a6a8a329024aed8f3d98eea8e4Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 51c128ba038cf1b79d605cbee325919b45ab95a5Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 1992fb261c90e9827cf5dc3115d89bb0853252c9Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 58051a284ac18a3bb815aac6289a679903ddcc3fAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 5de7665e0a0746b5ad7943554b34db8f8614a196Affected

LinuxLinux

2.6.12Affected
before 2.6.12Not affected
5.4.291 through 5.4.*Not affected
5.10.235 through 5.10.*Not affected
5.15.179 through 5.15.*Not affected
6.1.129 through 6.1.*Not affected
6.6.76 through 6.6.*Not affected
6.12.13 through 6.12.*Not affected
6.13.2 through 6.13.*Not affected
6.14 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.