Race Condition Vulnerability in Linux Kernel's Rose Protocol Implementation
Summary
CVE-2025-39826: In the Linux kernel, the following vulnerability has been resolved: net: rose: convert 'use' field to refcount_t The 'use' field in struct rose_neigh is used as a reference counter but lacks atomicity. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interaction. It is known for its stability, performance, and flexibility. The kernel supports various protocols, including the Rose protocol, which is used for X.25 networks. This vulnerability affects the 'use' field in the struct rose_neigh, which is intended to serve as a reference counter but lacks atomicity, making it susceptible to race conditions.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the Rose protocol implementation where the 'use' field in struct rose_neigh is used as a reference counter without atomic operations. This flaw can lead to race conditions, allowing the rose_neigh structure to be freed while still being referenced by other code paths. For instance, if rose_neigh->use reaches zero during an ioctl operation via rose_rt_ioctl(), the structure may be removed while its timer is still active, resulting in potential use-after-free issues. This vulnerability can lead to system instability and security risks, as it may allow unauthorized access to memory.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, no specific workarounds are provided for this vulnerability. The best course of action is to apply the patch by updating the package to the latest version.
Conclusion
The CVE-2025-39826 vulnerability in the Linux kernel's Rose protocol implementation poses significant risks due to race conditions and potential use-after-free issues. It is essential to update to the patched version 6.16.5-1 or later to ensure system security and stability. Utilizing tools like Vulert can help monitor for such vulnerabilities in your applications.
See every vulnerability recorded for linux →
FAQ
CVE-2025-39826 is a vulnerability in the Linux kernel related to the Rose protocol, where a race condition can occur due to improper reference counting.
This vulnerability can lead to race conditions and potential use-after-free issues, which may compromise system stability and security.
Versions of the Linux kernel prior to 6.16.5-1 are affected. It is advisable to check your kernel version and update if necessary.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check if your application is affected by using the Vulert playground at Vulert Scanner.
While no specific workarounds are available, it is crucial to plan for an update as soon as possible to mitigate the risks associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
