{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-38377", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:24.010Z", "datePublished": "2025-07-25T12:53:19.141Z", "dateUpdated": "2026-08-05T12:01:27.739Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:01:27.739Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrose: fix dangling neighbour pointers in rose_rt_device_down()\n\nThere are two bugs in rose_rt_device_down() that can cause\nuse-after-free:\n\n1. The loop bound `t->count` is modified within the loop, which can\n cause the loop to terminate early and miss some entries.\n\n2. When removing an entry from the neighbour array, the subsequent entries\n are moved up to fill the gap, but the loop index `i` is still\n incremented, causing the next entry to be skipped.\n\nFor example, if a node has three neighbours (A, A, B) with count=3 and A\nis being removed, the second A is not checked.\n\n i=0: (A, A, B) -> (A, B) with count=2\n ^ checked\n i=1: (A, B) -> (A, B) with count=2\n ^ checked (B, not A!)\n i=2: (doesn't occur because i < count is false)\n\nThis leaves the second A in the array with count=2, but the rose_neigh\nstructure has been freed. Code that accesses these entries assumes that\nthe first `count` entries are valid pointers, causing a use-after-free\nwhen it accesses the dangling pointer.\n\nFix both issues by iterating over the array in reverse order with a fixed\nloop bound. This ensures that all entries are examined and that the removal\nof an entry doesn't affect subsequent iterations." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:A - The dangling `rose_node->neighbour[]` entry is consumed by `rose_route_frame()` → `rose_get_neigh(..., route_frame=1)` while processing ROSE CALL REQUEST frames received from AX.25 peers, so a remote unauthenticated station drives the use-after-free. AX.25 rides radio/KISS TNC links or bpqether (ETH_P_BPQ) on the local Ethernet segment, making the attacker link-adjacent rather than internet-routable.\nAC:L - The poisoned entry arises from ordinary operation — `rose_add_node()` dedupes neighbours only on callsign+device and ignores the digipeater path, so a node legitimately configured with redundant paths through one neighbour already holds duplicate pointers, and every AX.25 port down cycle then frees the neighbour while leaving it referenced with `count` still positive. Once poisoned the entry persists indefinitely, and each injected CALL REQUEST deterministically dereferences the stale pointer with no race, timing window, or unpredictable memory layout, retryable at will to win the slab spray.\nPR:N - ROSE and AX.25 carry no authentication whatsoever, so a peer injecting frames on the segment needs no credentials to reach `rose_route_frame()`/`rose_get_neigh()` and dereference the freed `rose_neigh`. The same stale pointers are also reachable by any unprivileged local user through `connect()` on an AF_ROSE socket and through the world-readable `/proc/net/rose_nodes`.\nUI:N - Only received frames are required; `rose_route_frame()` runs from softirq on packet receive with no local user opening a file, mounting anything, or taking any other action.\nS:U - The corruption is confined to kernel heap objects within the kernel's own security authority, with no VM, IOMMU, or sandbox boundary crossed.\nC:H - The freed `rose_neigh` (a ~176-byte kmalloc object in a general-purpose slab that is trivially sprayed from unprivileged userspace or by the attacker's own skb traffic) is read back through `node->neighbour[i]->restarted`, `->number`, `->loopback`, `->dev` and `->digipeat`, so attacker-groomed data is interpreted as kernel pointers and leaked via `/proc/net/rose_nodes` and observable routing behaviour.\nI:H - The dangling pointer takes write operations directly — `new_neigh->use++`, `neigh->restarted = 0`, `skb_queue_tail(&neigh->queue, skb)` linking into a reclaimed list head, and `add_timer(&neigh->t0timer)`/`timer_delete(&neigh->ftimer)` on a reclaimed `timer_list` — while `rose_send_frame()` dereferences an attacker-controlled `neigh->dev` to read `dev->dev_addr` and hands it to `ax25_send_frame()`. Together these give write and list-corruption primitives with plausible control-flow hijack.\nA:H - The freed neighbour is still referenced by the node table and reached on every routing lookup, and its armed `ftimer`/`t0timer` plus the wild `->dev` dereference reliably produce a kernel oops or panic — as syzbot reproduced — and the crash can be re-triggered at will by any adjacent peer." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/rose/rose_route.c" ], "versions": [ { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "94e0918e39039c47ddceb609500817f7266be756", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "fe62a35fb1f77f494ed534fc69a9043dc5a30ce1", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "2b952dbb32fef835756f07ff0cd77efbb836dfea", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "b6b232e16e08c6dc120672b4753392df0d28c1b4", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "7a1841c9609377e989ec41c16551309ce79c39e4", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "446ac00b86be1670838e513b643933d78837d8db", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "2c6c82ee074bfcfd1bc978ec45bfea37703d840a", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "34a500caf48c47d5171f4aa1f237da39b07c6157", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/rose/rose_route.c" ], "versions": [ { "version": "2.6.12", "status": "affected" }, { "version": "0", "lessThan": "2.6.12", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.296", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.240", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.187", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.144", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.97", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.37", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.15.6", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "5.4.296" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "5.10.240" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "5.15.187" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.1.144" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.6.97" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.12.37" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.15.6" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.16" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/94e0918e39039c47ddceb609500817f7266be756" }, { "url": "https://git.kernel.org/stable/c/fe62a35fb1f77f494ed534fc69a9043dc5a30ce1" }, { "url": "https://git.kernel.org/stable/c/2b952dbb32fef835756f07ff0cd77efbb836dfea" }, { "url": "https://git.kernel.org/stable/c/b6b232e16e08c6dc120672b4753392df0d28c1b4" }, { "url": "https://git.kernel.org/stable/c/7a1841c9609377e989ec41c16551309ce79c39e4" }, { "url": "https://git.kernel.org/stable/c/446ac00b86be1670838e513b643933d78837d8db" }, { "url": "https://git.kernel.org/stable/c/2c6c82ee074bfcfd1bc978ec45bfea37703d840a" }, { "url": "https://git.kernel.org/stable/c/34a500caf48c47d5171f4aa1f237da39b07c6157" } ], "title": "rose: fix dangling neighbour pointers in rose_rt_device_down()", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:37:14.330Z" } } ] } }