In the Linux kernel, the following vulnerability has been resolved:
net: rose: include node references in rose_neigh refcount
Current implementation maintains two separate reference counting mechanisms: the 'count' field in struct roseneigh tracks references from rosenode structures, while the 'use' field (now refcountt) tracks references from rosesock.
This patch merges these two reference counting systems using 'use' field for proper reference management. Specifically, this patch adds incrementing and decrementing of roseneigh->use when roseneigh->count is incremented or decremented.
This patch also modifies rosertfree(), rosertdevicedown() and roseclearroute() to properly release references to roseneigh objects before freeing a rosenode through roseremove_node().
These changes ensure roseneigh structures are properly freed only when all references, including those from rosenode structures, are released. As a result, this resolves a slab-use-after-free issue reported by Syzbot.
[
{
"deprecated": false,
"target": {
"function": "rose_add_node",
"file": "net/rose/rose_route.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9c547c8eee9d1cf6e744611d688b9f725cf9a115",
"digest": {
"function_hash": "296008095977053329971846925874403233269",
"length": 2534.0
},
"id": "CVE-2025-39827-033f7a28",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"function": "rose_clear_routes",
"file": "net/rose/rose_route.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9c547c8eee9d1cf6e744611d688b9f725cf9a115",
"digest": {
"function_hash": "111074768728085708382255070069989169382",
"length": 514.0
},
"id": "CVE-2025-39827-039d2708",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"function": "rose_rt_free",
"file": "net/rose/rose_route.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@384210cceb1873a4c8218b27ba0745444436b728",
"digest": {
"function_hash": "274975817118080336101184376537009628009",
"length": 397.0
},
"id": "CVE-2025-39827-083664b8",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"function": "rose_rt_device_down",
"file": "net/rose/rose_route.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da9c9c877597170b929a6121a68dcd3dd9a80f45",
"digest": {
"function_hash": "108860486643622469014002637820409842007",
"length": 786.0
},
"id": "CVE-2025-39827-0a89c3b3",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"function": "rose_add_node",
"file": "net/rose/rose_route.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@384210cceb1873a4c8218b27ba0745444436b728",
"digest": {
"function_hash": "296008095977053329971846925874403233269",
"length": 2534.0
},
"id": "CVE-2025-39827-0d137d89",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"function": "rose_add_loopback_node",
"file": "net/rose/rose_route.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@384210cceb1873a4c8218b27ba0745444436b728",
"digest": {
"function_hash": "224992258609777325183334153338267043252",
"length": 693.0
},
"id": "CVE-2025-39827-16ca570d",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"function": "rose_rt_free",
"file": "net/rose/rose_route.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da9c9c877597170b929a6121a68dcd3dd9a80f45",
"digest": {
"function_hash": "274975817118080336101184376537009628009",
"length": 397.0
},
"id": "CVE-2025-39827-17870df2",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"function": "rose_add_node",
"file": "net/rose/rose_route.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da9c9c877597170b929a6121a68dcd3dd9a80f45",
"digest": {
"function_hash": "296008095977053329971846925874403233269",
"length": 2534.0
},
"id": "CVE-2025-39827-185896a0",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"function": "rose_del_loopback_node",
"file": "net/rose/rose_route.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d7563b456ed44151e1a82091d96f60166daea89b",
"digest": {
"function_hash": "67660396119183213863558945679496046377",
"length": 397.0
},
"id": "CVE-2025-39827-1d457570",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"function": "rose_clear_routes",
"file": "net/rose/rose_route.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@384210cceb1873a4c8218b27ba0745444436b728",
"digest": {
"function_hash": "111074768728085708382255070069989169382",
"length": 514.0
},
"id": "CVE-2025-39827-23a61d7f",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"function": "rose_del_node",
"file": "net/rose/rose_route.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9c547c8eee9d1cf6e744611d688b9f725cf9a115",
"digest": {
"function_hash": "98926256570838382139760360123207733015",
"length": 1221.0
},
"id": "CVE-2025-39827-2a6444d6",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"function": "rose_clear_routes",
"file": "net/rose/rose_route.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d7563b456ed44151e1a82091d96f60166daea89b",
"digest": {
"function_hash": "111074768728085708382255070069989169382",
"length": 514.0
},
"id": "CVE-2025-39827-42d07c2b",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"function": "rose_neigh_show",
"file": "net/rose/rose_route.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9c547c8eee9d1cf6e744611d688b9f725cf9a115",
"digest": {
"function_hash": "25159400510816717144358391609161140612",
"length": 862.0
},
"id": "CVE-2025-39827-63a753e9",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"function": "rose_del_node",
"file": "net/rose/rose_route.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da9c9c877597170b929a6121a68dcd3dd9a80f45",
"digest": {
"function_hash": "98926256570838382139760360123207733015",
"length": 1221.0
},
"id": "CVE-2025-39827-699a8e38",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/rose/rose_route.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9c547c8eee9d1cf6e744611d688b9f725cf9a115",
"digest": {
"threshold": 0.9,
"line_hashes": [
"173533645506483023605161880438883757515",
"116426532756916769847940802403650060974",
"276345802334401201861009337002237356136",
"139884149367666590111045608886109904004",
"218709589024207179365584340583700158156",
"328703838396586237630733043017407917505",
"326277141747805883532620480860380375855",
"8473877719058969734119005159413593663",
"187175680004616277144312853977256421857",
"62166009370423147450622204401301334104",
"3799790275540893365623815183073872425",
"38645708877101564033064146749176318499",
"293070010608920707066037422498733780284",
"152791905915928367150590166666826259093",
"30932304080185181022390381414149295490",
"24883167156822543631209142184587249740",
"98589057747400229875049096848972288826",
"149134197467060330780886703215217305806",
"124324726027720614194140664179337592518",
"45893630300599214130734244985726320076",
"155353191645637339625208325620401001790",
"11193317809522942025950356013329941782",
"226339075825242392342325556907284620512",
"31109017058483357012804368533447884370",
"117534599384794185137359658804640117656",
"253607861044762113645190500032739860275",
"291216687896906629833331027596286949471",
"40033056978629888914624879064795883764",
"8692995972061818640026269151252383190",
"113426200968878165472872881084361183399",
"195087142797088681027761625525822595133",
"288082856069611540729109449024745588103",
"122529232823834812600444098114068205728",
"134124884724786398220495442372725816420",
"152291480200152977081429220128365927992",
"292178050829252242071090321207431199962",
"263174910768561814856347463770599918687",
"157422748209289687116055207699380523874",
"154973066326295800386964050262868820626",
"117064340806616368043050987557584214416",
"158685632080067825056464445337630146057",
"76521284539238453881084233327533714457",
"302768686242709497110761526807502387393",
"195153833513493736173844391599116524142"
]
},
"id": "CVE-2025-39827-6b4df736",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/rose/rose_route.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d7563b456ed44151e1a82091d96f60166daea89b",
"digest": {
"threshold": 0.9,
"line_hashes": [
"173533645506483023605161880438883757515",
"116426532756916769847940802403650060974",
"276345802334401201861009337002237356136",
"139884149367666590111045608886109904004",
"218709589024207179365584340583700158156",
"328703838396586237630733043017407917505",
"326277141747805883532620480860380375855",
"8473877719058969734119005159413593663",
"187175680004616277144312853977256421857",
"62166009370423147450622204401301334104",
"3799790275540893365623815183073872425",
"38645708877101564033064146749176318499",
"293070010608920707066037422498733780284",
"152791905915928367150590166666826259093",
"30932304080185181022390381414149295490",
"24883167156822543631209142184587249740",
"98589057747400229875049096848972288826",
"149134197467060330780886703215217305806",
"124324726027720614194140664179337592518",
"45893630300599214130734244985726320076",
"155353191645637339625208325620401001790",
"11193317809522942025950356013329941782",
"226339075825242392342325556907284620512",
"31109017058483357012804368533447884370",
"117534599384794185137359658804640117656",
"253607861044762113645190500032739860275",
"291216687896906629833331027596286949471",
"40033056978629888914624879064795883764",
"8692995972061818640026269151252383190",
"113426200968878165472872881084361183399",
"195087142797088681027761625525822595133",
"288082856069611540729109449024745588103",
"122529232823834812600444098114068205728",
"134124884724786398220495442372725816420",
"152291480200152977081429220128365927992",
"292178050829252242071090321207431199962",
"263174910768561814856347463770599918687",
"157422748209289687116055207699380523874",
"154973066326295800386964050262868820626",
"117064340806616368043050987557584214416",
"158685632080067825056464445337630146057",
"76521284539238453881084233327533714457",
"302768686242709497110761526807502387393",
"195153833513493736173844391599116524142"
]
},
"id": "CVE-2025-39827-6c31e27a",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"function": "rose_del_node",
"file": "net/rose/rose_route.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d7563b456ed44151e1a82091d96f60166daea89b",
"digest": {
"function_hash": "98926256570838382139760360123207733015",
"length": 1221.0
},
"id": "CVE-2025-39827-6c470911",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"function": "rose_del_loopback_node",
"file": "net/rose/rose_route.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da9c9c877597170b929a6121a68dcd3dd9a80f45",
"digest": {
"function_hash": "67660396119183213863558945679496046377",
"length": 397.0
},
"id": "CVE-2025-39827-6db3f7a4",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"function": "rose_add_loopback_node",
"file": "net/rose/rose_route.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d7563b456ed44151e1a82091d96f60166daea89b",
"digest": {
"function_hash": "224992258609777325183334153338267043252",
"length": 693.0
},
"id": "CVE-2025-39827-70b474cc",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"function": "rose_del_loopback_node",
"file": "net/rose/rose_route.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9c547c8eee9d1cf6e744611d688b9f725cf9a115",
"digest": {
"function_hash": "67660396119183213863558945679496046377",
"length": 397.0
},
"id": "CVE-2025-39827-75f0e836",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"function": "rose_rt_free",
"file": "net/rose/rose_route.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d7563b456ed44151e1a82091d96f60166daea89b",
"digest": {
"function_hash": "274975817118080336101184376537009628009",
"length": 397.0
},
"id": "CVE-2025-39827-775078c4",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"function": "rose_neigh_show",
"file": "net/rose/rose_route.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d7563b456ed44151e1a82091d96f60166daea89b",
"digest": {
"function_hash": "25159400510816717144358391609161140612",
"length": 862.0
},
"id": "CVE-2025-39827-899d58f4",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"function": "rose_rt_device_down",
"file": "net/rose/rose_route.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@384210cceb1873a4c8218b27ba0745444436b728",
"digest": {
"function_hash": "108860486643622469014002637820409842007",
"length": 786.0
},
"id": "CVE-2025-39827-8d68b603",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/rose/rose_route.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da9c9c877597170b929a6121a68dcd3dd9a80f45",
"digest": {
"threshold": 0.9,
"line_hashes": [
"173533645506483023605161880438883757515",
"116426532756916769847940802403650060974",
"276345802334401201861009337002237356136",
"139884149367666590111045608886109904004",
"218709589024207179365584340583700158156",
"328703838396586237630733043017407917505",
"326277141747805883532620480860380375855",
"8473877719058969734119005159413593663",
"187175680004616277144312853977256421857",
"62166009370423147450622204401301334104",
"3799790275540893365623815183073872425",
"38645708877101564033064146749176318499",
"293070010608920707066037422498733780284",
"152791905915928367150590166666826259093",
"30932304080185181022390381414149295490",
"24883167156822543631209142184587249740",
"98589057747400229875049096848972288826",
"149134197467060330780886703215217305806",
"124324726027720614194140664179337592518",
"45893630300599214130734244985726320076",
"155353191645637339625208325620401001790",
"11193317809522942025950356013329941782",
"226339075825242392342325556907284620512",
"31109017058483357012804368533447884370",
"117534599384794185137359658804640117656",
"253607861044762113645190500032739860275",
"291216687896906629833331027596286949471",
"40033056978629888914624879064795883764",
"8692995972061818640026269151252383190",
"113426200968878165472872881084361183399",
"195087142797088681027761625525822595133",
"288082856069611540729109449024745588103",
"122529232823834812600444098114068205728",
"134124884724786398220495442372725816420",
"152291480200152977081429220128365927992",
"292178050829252242071090321207431199962",
"263174910768561814856347463770599918687",
"157422748209289687116055207699380523874",
"154973066326295800386964050262868820626",
"117064340806616368043050987557584214416",
"158685632080067825056464445337630146057",
"76521284539238453881084233327533714457",
"302768686242709497110761526807502387393",
"195153833513493736173844391599116524142"
]
},
"id": "CVE-2025-39827-8f00d559",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"function": "rose_add_node",
"file": "net/rose/rose_route.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d7563b456ed44151e1a82091d96f60166daea89b",
"digest": {
"function_hash": "296008095977053329971846925874403233269",
"length": 2534.0
},
"id": "CVE-2025-39827-927b95ef",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"function": "rose_add_loopback_node",
"file": "net/rose/rose_route.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9c547c8eee9d1cf6e744611d688b9f725cf9a115",
"digest": {
"function_hash": "224992258609777325183334153338267043252",
"length": 693.0
},
"id": "CVE-2025-39827-92ae3870",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"function": "rose_add_loopback_node",
"file": "net/rose/rose_route.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da9c9c877597170b929a6121a68dcd3dd9a80f45",
"digest": {
"function_hash": "224992258609777325183334153338267043252",
"length": 693.0
},
"id": "CVE-2025-39827-9dfe180e",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"function": "rose_rt_device_down",
"file": "net/rose/rose_route.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d7563b456ed44151e1a82091d96f60166daea89b",
"digest": {
"function_hash": "108860486643622469014002637820409842007",
"length": 786.0
},
"id": "CVE-2025-39827-aa16461d",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"function": "rose_neigh_show",
"file": "net/rose/rose_route.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@384210cceb1873a4c8218b27ba0745444436b728",
"digest": {
"function_hash": "25159400510816717144358391609161140612",
"length": 862.0
},
"id": "CVE-2025-39827-af397c97",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"function": "rose_del_loopback_node",
"file": "net/rose/rose_route.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@384210cceb1873a4c8218b27ba0745444436b728",
"digest": {
"function_hash": "67660396119183213863558945679496046377",
"length": 397.0
},
"id": "CVE-2025-39827-af6d63b6",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"function": "rose_clear_routes",
"file": "net/rose/rose_route.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da9c9c877597170b929a6121a68dcd3dd9a80f45",
"digest": {
"function_hash": "111074768728085708382255070069989169382",
"length": 514.0
},
"id": "CVE-2025-39827-b85e251b",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"function": "rose_del_node",
"file": "net/rose/rose_route.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@384210cceb1873a4c8218b27ba0745444436b728",
"digest": {
"function_hash": "98926256570838382139760360123207733015",
"length": 1221.0
},
"id": "CVE-2025-39827-c4549abf",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"function": "rose_rt_device_down",
"file": "net/rose/rose_route.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9c547c8eee9d1cf6e744611d688b9f725cf9a115",
"digest": {
"function_hash": "108860486643622469014002637820409842007",
"length": 786.0
},
"id": "CVE-2025-39827-d5805331",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/rose/rose_route.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@384210cceb1873a4c8218b27ba0745444436b728",
"digest": {
"threshold": 0.9,
"line_hashes": [
"173533645506483023605161880438883757515",
"116426532756916769847940802403650060974",
"276345802334401201861009337002237356136",
"139884149367666590111045608886109904004",
"218709589024207179365584340583700158156",
"328703838396586237630733043017407917505",
"326277141747805883532620480860380375855",
"8473877719058969734119005159413593663",
"187175680004616277144312853977256421857",
"62166009370423147450622204401301334104",
"3799790275540893365623815183073872425",
"38645708877101564033064146749176318499",
"293070010608920707066037422498733780284",
"152791905915928367150590166666826259093",
"30932304080185181022390381414149295490",
"24883167156822543631209142184587249740",
"98589057747400229875049096848972288826",
"149134197467060330780886703215217305806",
"124324726027720614194140664179337592518",
"45893630300599214130734244985726320076",
"155353191645637339625208325620401001790",
"11193317809522942025950356013329941782",
"226339075825242392342325556907284620512",
"31109017058483357012804368533447884370",
"117534599384794185137359658804640117656",
"253607861044762113645190500032739860275",
"291216687896906629833331027596286949471",
"40033056978629888914624879064795883764",
"8692995972061818640026269151252383190",
"113426200968878165472872881084361183399",
"195087142797088681027761625525822595133",
"288082856069611540729109449024745588103",
"122529232823834812600444098114068205728",
"134124884724786398220495442372725816420",
"152291480200152977081429220128365927992",
"292178050829252242071090321207431199962",
"263174910768561814856347463770599918687",
"157422748209289687116055207699380523874",
"154973066326295800386964050262868820626",
"117064340806616368043050987557584214416",
"158685632080067825056464445337630146057",
"76521284539238453881084233327533714457",
"302768686242709497110761526807502387393",
"195153833513493736173844391599116524142"
]
},
"id": "CVE-2025-39827-e78c9e6d",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"function": "rose_rt_free",
"file": "net/rose/rose_route.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9c547c8eee9d1cf6e744611d688b9f725cf9a115",
"digest": {
"function_hash": "274975817118080336101184376537009628009",
"length": 397.0
},
"id": "CVE-2025-39827-f114f16b",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"function": "rose_neigh_show",
"file": "net/rose/rose_route.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da9c9c877597170b929a6121a68dcd3dd9a80f45",
"digest": {
"function_hash": "25159400510816717144358391609161140612",
"length": 862.0
},
"id": "CVE-2025-39827-f1e36c48",
"signature_version": "v1"
}
]