CVE-2025-39826

HIGH

MEDIUM Priority: 0.02 BB Relevance: 29/100

Published: 2025-09-16 Modified: 2026-11-10 First seen: 2026-11-10 Status: active

Attack Surface

No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Local

AC: High

PR: Low

UI: None

S: Unchanged

C: High

I: High

A: High

Description

In the Linux kernel, the following vulnerability has been resolved: net: rose: convert 'use' field to refcount_t The 'use' field in struct rose_neigh is used as a reference counter but lacks atomicity. This can lead to race conditions where a rose_neigh structure is freed while still being referenced by other code paths. For example, when rose_neigh->use becomes zero during an ioctl operation via rose_rt_ioctl(), the structure may be removed while its timer is still active, potentially causing use-after-free issues. This patch changes the type of 'use' from unsigned short to refcount_t and updates all code paths to use rose_neigh_hold() and rose_neigh_put() which operate reference counts atomically.

Weakness Classification (1)

CWE-416

Affected Software (16)

Vendor	Product	Version
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < fb07156cc0742ba4e93dfcc84280c011d05b301f
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < f8c29fc437d03a98fb075c31c5be761cc8326284
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 0085b250fcc79f900c82a69980ec2f3e1871823b
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 203e4f42596ede31498744018716a3db6dbb7f51
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < d860d1faa6b2ce3becfdb8b0c2b048ad31800061
Linux	Linux	2.6.12
debian	debian_linux	11.0
linux	linux_kernel	2.6.12.1 – 6.1.150
linux	linux_kernel	2.6.12
linux	linux_kernel	2.6.12
linux	linux_kernel	2.6.12
linux	linux_kernel	2.6.12
linux	linux_kernel	2.6.12
linux	linux_kernel	6.17
linux	linux_kernel	6.17
linux	linux_kernel	6.17