NetSight
IP …
high8.8

CVE-2025-39826

In the Linux kernel, the following vulnerability has been resolved: net: rose: convert 'use' field to refcount_t The 'use' field in struct rose_neigh is used a…

Impact

In the Linux kernel, the following vulnerability has been resolved: net: rose: convert 'use' field to refcount_t The 'use' field in struct rose_neigh is used as a reference counter but lacks atomicity. This can lead to race conditions where a rose_neigh structure is freed while still being referenced by other code paths. For example, when rose_neigh->use becomes zero during an ioctl operation via rose_rt_ioctl(), the structure may be removed while its timer is still active, potentially causing use-after-free issues. This patch changes the type of 'use' from unsigned short to refcount_t and updates all code paths to use rose_neigh_hold() and rose_neigh_put() which operate reference counts atomically.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 2.6.12.1 before 6.1.150
from 6.2 before 6.6.104
from 6.7 before 6.12.45
from 6.13 before 6.16.5
Versions 2.6.12, 6.17
DebianDebian Linux
Version 11.0

Weakness classification

CWE-416

References