CVE-2025-39826

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-39826
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-39826.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-39826
Downstream
Related
Published
2025-09-16T13:00:24.618Z
Modified
2026-03-12T02:17:17.161594Z
Summary
net: rose: convert 'use' field to refcount_t
Details

In the Linux kernel, the following vulnerability has been resolved:

net: rose: convert 'use' field to refcount_t

The 'use' field in struct roseneigh is used as a reference counter but lacks atomicity. This can lead to race conditions where a roseneigh structure is freed while still being referenced by other code paths.

For example, when roseneigh->use becomes zero during an ioctl operation via rosert_ioctl(), the structure may be removed while its timer is still active, potentially causing use-after-free issues.

This patch changes the type of 'use' from unsigned short to refcountt and updates all code paths to use roseneighhold() and roseneigh_put() which operate reference counts atomically.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/39xxx/CVE-2025-39826.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Fixed
fb07156cc0742ba4e93dfcc84280c011d05b301f
Fixed
f8c29fc437d03a98fb075c31c5be761cc8326284
Fixed
0085b250fcc79f900c82a69980ec2f3e1871823b
Fixed
203e4f42596ede31498744018716a3db6dbb7f51
Fixed
d860d1faa6b2ce3becfdb8b0c2b048ad31800061

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-39826.json"