In the Linux kernel, the following vulnerability has been resolved:
rose: fix dangling neighbour pointers in rosertdevice_down()
There are two bugs in rosertdevice_down() that can cause use-after-free:
The loop bound t->count is modified within the loop, which can
cause the loop to terminate early and miss some entries.
When removing an entry from the neighbour array, the subsequent entries
are moved up to fill the gap, but the loop index i is still
incremented, causing the next entry to be skipped.
For example, if a node has three neighbours (A, A, B) with count=3 and A is being removed, the second A is not checked.
i=0: (A, A, B) -> (A, B) with count=2
^ checked
i=1: (A, B) -> (A, B) with count=2
^ checked (B, not A!)
i=2: (doesn't occur because i < count is false)
This leaves the second A in the array with count=2, but the rose_neigh
structure has been freed. Code that accesses these entries assumes that
the first count entries are valid pointers, causing a use-after-free
when it accesses the dangling pointer.
Fix both issues by iterating over the array in reverse order with a fixed loop bound. This ensures that all entries are examined and that the removal of an entry doesn't affect subsequent iterations.
[
{
"id": "CVE-2025-38377-14fc1bb5",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "net/rose/rose_route.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@446ac00b86be1670838e513b643933d78837d8db",
"digest": {
"line_hashes": [
"333128723447713189429847302164033879977",
"74180029475810262953413917140177264811",
"235559453075650611662561844573520645719",
"46575350036828000983571628336506184031",
"264080118385780893350461724304430007704",
"298148097318864761158544150660154447768",
"139896724237820366566571196329759664505",
"197558730407933173663572721768322954387",
"301219897651018165796076644564010125132",
"47219056316497480524531463853615290474",
"157140727960817923471025328845830967764",
"312107913382624232992058937118125278689",
"126017641260532524009780033940581780328",
"229584473172836835728680136525658746292",
"142524124513442124383353630288712437526",
"170300634614355018671277967359538732865",
"209941540537620217013037643932806989505"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2025-38377-162befa6",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "net/rose/rose_route.c",
"function": "rose_rt_device_down"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2b952dbb32fef835756f07ff0cd77efbb836dfea",
"digest": {
"length": 802.0,
"function_hash": "201800367324122682809027084494632134297"
},
"signature_type": "Function"
},
{
"id": "CVE-2025-38377-171c612a",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "net/rose/rose_route.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@94e0918e39039c47ddceb609500817f7266be756",
"digest": {
"line_hashes": [
"333128723447713189429847302164033879977",
"74180029475810262953413917140177264811",
"235559453075650611662561844573520645719",
"46575350036828000983571628336506184031",
"264080118385780893350461724304430007704",
"298148097318864761158544150660154447768",
"139896724237820366566571196329759664505",
"192241456475135326004400289440932885866",
"340243703580999593403446607763498149855",
"166636202649589955120214818474741965805",
"312107913382624232992058937118125278689",
"126017641260532524009780033940581780328",
"229584473172836835728680136525658746292",
"142524124513442124383353630288712437526",
"170300634614355018671277967359538732865",
"209941540537620217013037643932806989505"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2025-38377-183a4831",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "net/rose/rose_route.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c6c82ee074bfcfd1bc978ec45bfea37703d840a",
"digest": {
"line_hashes": [
"333128723447713189429847302164033879977",
"74180029475810262953413917140177264811",
"235559453075650611662561844573520645719",
"46575350036828000983571628336506184031",
"264080118385780893350461724304430007704",
"298148097318864761158544150660154447768",
"139896724237820366566571196329759664505",
"197558730407933173663572721768322954387",
"301219897651018165796076644564010125132",
"47219056316497480524531463853615290474",
"157140727960817923471025328845830967764",
"312107913382624232992058937118125278689",
"126017641260532524009780033940581780328",
"229584473172836835728680136525658746292",
"142524124513442124383353630288712437526",
"170300634614355018671277967359538732865",
"209941540537620217013037643932806989505"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2025-38377-28189af7",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "net/rose/rose_route.c",
"function": "rose_rt_device_down"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@446ac00b86be1670838e513b643933d78837d8db",
"digest": {
"length": 802.0,
"function_hash": "201800367324122682809027084494632134297"
},
"signature_type": "Function"
},
{
"id": "CVE-2025-38377-2a875d30",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "net/rose/rose_route.c",
"function": "rose_rt_device_down"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c6c82ee074bfcfd1bc978ec45bfea37703d840a",
"digest": {
"length": 802.0,
"function_hash": "201800367324122682809027084494632134297"
},
"signature_type": "Function"
},
{
"id": "CVE-2025-38377-3930cdf9",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "net/rose/rose_route.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b6b232e16e08c6dc120672b4753392df0d28c1b4",
"digest": {
"line_hashes": [
"333128723447713189429847302164033879977",
"74180029475810262953413917140177264811",
"235559453075650611662561844573520645719",
"46575350036828000983571628336506184031",
"264080118385780893350461724304430007704",
"298148097318864761158544150660154447768",
"139896724237820366566571196329759664505",
"197558730407933173663572721768322954387",
"301219897651018165796076644564010125132",
"47219056316497480524531463853615290474",
"157140727960817923471025328845830967764",
"312107913382624232992058937118125278689",
"126017641260532524009780033940581780328",
"229584473172836835728680136525658746292",
"142524124513442124383353630288712437526",
"170300634614355018671277967359538732865",
"209941540537620217013037643932806989505"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2025-38377-4f698ed9",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "net/rose/rose_route.c",
"function": "rose_rt_device_down"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@34a500caf48c47d5171f4aa1f237da39b07c6157",
"digest": {
"length": 802.0,
"function_hash": "201800367324122682809027084494632134297"
},
"signature_type": "Function"
},
{
"id": "CVE-2025-38377-6d838ea0",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "net/rose/rose_route.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7a1841c9609377e989ec41c16551309ce79c39e4",
"digest": {
"line_hashes": [
"333128723447713189429847302164033879977",
"74180029475810262953413917140177264811",
"235559453075650611662561844573520645719",
"46575350036828000983571628336506184031",
"264080118385780893350461724304430007704",
"298148097318864761158544150660154447768",
"139896724237820366566571196329759664505",
"197558730407933173663572721768322954387",
"301219897651018165796076644564010125132",
"47219056316497480524531463853615290474",
"157140727960817923471025328845830967764",
"312107913382624232992058937118125278689",
"126017641260532524009780033940581780328",
"229584473172836835728680136525658746292",
"142524124513442124383353630288712437526",
"170300634614355018671277967359538732865",
"209941540537620217013037643932806989505"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2025-38377-8da2f912",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "net/rose/rose_route.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2b952dbb32fef835756f07ff0cd77efbb836dfea",
"digest": {
"line_hashes": [
"333128723447713189429847302164033879977",
"74180029475810262953413917140177264811",
"235559453075650611662561844573520645719",
"46575350036828000983571628336506184031",
"264080118385780893350461724304430007704",
"298148097318864761158544150660154447768",
"139896724237820366566571196329759664505",
"197558730407933173663572721768322954387",
"301219897651018165796076644564010125132",
"47219056316497480524531463853615290474",
"157140727960817923471025328845830967764",
"312107913382624232992058937118125278689",
"126017641260532524009780033940581780328",
"229584473172836835728680136525658746292",
"142524124513442124383353630288712437526",
"170300634614355018671277967359538732865",
"209941540537620217013037643932806989505"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2025-38377-9298913b",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "net/rose/rose_route.c",
"function": "rose_rt_device_down"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7a1841c9609377e989ec41c16551309ce79c39e4",
"digest": {
"length": 802.0,
"function_hash": "201800367324122682809027084494632134297"
},
"signature_type": "Function"
},
{
"id": "CVE-2025-38377-96476732",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "net/rose/rose_route.c",
"function": "rose_rt_device_down"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b6b232e16e08c6dc120672b4753392df0d28c1b4",
"digest": {
"length": 802.0,
"function_hash": "201800367324122682809027084494632134297"
},
"signature_type": "Function"
},
{
"id": "CVE-2025-38377-c31edb52",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "net/rose/rose_route.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@34a500caf48c47d5171f4aa1f237da39b07c6157",
"digest": {
"line_hashes": [
"333128723447713189429847302164033879977",
"74180029475810262953413917140177264811",
"235559453075650611662561844573520645719",
"46575350036828000983571628336506184031",
"264080118385780893350461724304430007704",
"298148097318864761158544150660154447768",
"139896724237820366566571196329759664505",
"197558730407933173663572721768322954387",
"301219897651018165796076644564010125132",
"47219056316497480524531463853615290474",
"157140727960817923471025328845830967764",
"312107913382624232992058937118125278689",
"126017641260532524009780033940581780328",
"229584473172836835728680136525658746292",
"142524124513442124383353630288712437526",
"170300634614355018671277967359538732865",
"209941540537620217013037643932806989505"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2025-38377-c6df503f",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "net/rose/rose_route.c",
"function": "rose_rt_device_down"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fe62a35fb1f77f494ed534fc69a9043dc5a30ce1",
"digest": {
"length": 802.0,
"function_hash": "201800367324122682809027084494632134297"
},
"signature_type": "Function"
},
{
"id": "CVE-2025-38377-f84ff3d7",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "net/rose/rose_route.c",
"function": "rose_rt_device_down"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@94e0918e39039c47ddceb609500817f7266be756",
"digest": {
"length": 788.0,
"function_hash": "175672268801932498443958062935172120009"
},
"signature_type": "Function"
},
{
"id": "CVE-2025-38377-fa17f170",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "net/rose/rose_route.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fe62a35fb1f77f494ed534fc69a9043dc5a30ce1",
"digest": {
"line_hashes": [
"333128723447713189429847302164033879977",
"74180029475810262953413917140177264811",
"235559453075650611662561844573520645719",
"46575350036828000983571628336506184031",
"264080118385780893350461724304430007704",
"298148097318864761158544150660154447768",
"139896724237820366566571196329759664505",
"197558730407933173663572721768322954387",
"301219897651018165796076644564010125132",
"47219056316497480524531463853615290474",
"157140727960817923471025328845830967764",
"312107913382624232992058937118125278689",
"126017641260532524009780033940581780328",
"229584473172836835728680136525658746292",
"142524124513442124383353630288712437526",
"170300634614355018671277967359538732865",
"209941540537620217013037643932806989505"
],
"threshold": 0.9
},
"signature_type": "Line"
}
]