Riskcovery

CVE-2025-39826

net: rose: convert 'use' field to refcount_t

State
Published
Severity
8.8 High
Published
Sep 16, 2025
Updated
Oct 15, 2026
Reserved
Apr 16, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

net: rose: convert 'use' field to refcount_t

The 'use' field in struct rose_neigh is used as a reference counter but lacks atomicity. This can lead to race conditions where a rose_neigh structure is freed while still being referenced by other code paths.

For example, when rose_neigh->use becomes zero during an ioctl operation via rose_rt_ioctl(), the structure may be removed while its timer is still active, potentially causing use-after-free issues.

This patch changes the type of 'use' from unsigned short to refcount_t and updates all code paths to use rose_neigh_hold() and rose_neigh_put() which operate reference counts atomically.

Scores

CVSSScoreVectorSource
3.18.8 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before fb07156cc0742ba4e93dfcc84280c011d05b301fAffected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before f8c29fc437d03a98fb075c31c5be761cc8326284Affected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 0085b250fcc79f900c82a69980ec2f3e1871823bAffected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 203e4f42596ede31498744018716a3db6dbb7f51Affected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before d860d1faa6b2ce3becfdb8b0c2b048ad31800061Affected
LinuxLinux
  • 2.6.12Affected
  • before 2.6.12Not affected
  • 6.1.150 through 6.1.*Not affected
  • 6.6.104 through 6.6.*Not affected
  • 6.12.45 through 6.12.*Not affected
  • 6.16.5 through 6.16.*Not affected
  • 6.17 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.