CVE-2025-39826: net: rose: convert 'use' field to refcount_t

Description

In the Linux kernel, the following vulnerability has been resolved: net: rose: convert 'use' field to refcount_t The 'use' field in struct rose_neigh is used as a reference counter but lacks atomicity. This can lead to race conditions where a rose_neigh structure is freed while still being referenced by other code paths. For example, when rose_neigh->use becomes zero during an ioctl operation via rose_rt_ioctl(), the structure may be removed while its timer is still active, potentially causing use-after-free issues. This patch changes the type of 'use' from unsigned short to refcount_t and updates all code paths to use rose_neigh_hold() and rose_neigh_put() which operate reference counts atomically.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < fb07156cc0742ba4e93dfcc84280c011d05b301faffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < f8c29fc437d03a98fb075c31c5be761cc8326284affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 0085b250fcc79f900c82a69980ec2f3e1871823baffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 203e4f42596ede31498744018716a3db6dbb7f51affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < d860d1faa6b2ce3becfdb8b0c2b048ad31800061affected

Linux Linux

Default version status: affected

2.6.12affected
0 to < 2.6.12unaffected
6.1.150 to ≤ 6.1.*unaffected
6.6.104 to ≤ 6.6.*unaffected
6.12.45 to ≤ 6.12.*unaffected
6.16.5 to ≤ 6.16.*unaffected
6.17 to ≤ *unaffected

CVE-2025-39826

net: rose: convert 'use' field to refcount_t

Description

Affected products

Linux Linux

Linux Linux

References