CVE-2025-39827

Vulnerability

The vulnerability resides in the Linux kernel's ROSE (amateur radio AX.25) protocol implementation. The struct rose_neigh maintained two separate reference counters: count for references from rose_node structures and use for references from rose_sock. This separation allowed the count to be decremented without adjusting the use refcount, leading to premature freeing of rose_neigh objects while still referenced.

Exploitation

The issue can be triggered when functions such as rose_rt_free(), rose_rt_device_down(), or rose_clear_route() release a rose_node without properly releasing the associated rose_neigh through the use refcount. An attacker with local access to a system using the ROSE protocol could potentially trigger the vulnerable code path.

Impact

A successful exploit results in a slab-use-after-free condition, which could cause a kernel crash or potentially allow an attacker to escalate privileges or leak sensitive kernel memory.

Mitigation

The fix merges the two reference counting systems into the use field and modifies the relevant functions to correctly release references before freeing nodes. Patches have been committed to the Linux kernel stable tree. Users should apply the latest kernel updates to mitigate the risk. According to a Siemens ProductCERT advisory, this vulnerability also affects SIMATIC CN 4100 devices [1].