CVE-2025-39827

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: rose: include node references in rose_neigh refcount

Current implementation maintains two separate reference counting

mechanisms: the 'count' field in struct rose_neigh tracks references from

rose_node structures, while the 'use' field (now refcount_t) tracks

references from rose_sock.

This patch merges these two reference counting systems using 'use' field

for proper reference management. Specifically, this patch adds incrementing

and decrementing of rose_neigh->use when rose_neigh->count is incremented

or decremented.

This patch also modifies rose_rt_free(), rose_rt_device_down() and

rose_clear_route() to properly release references to rose_neigh objects

before freeing a rose_node through rose_remove_node().

These changes ensure rose_neigh structures are properly freed only when

all references, including those from rose_node structures, are released.

As a result, this resolves a slab-use-after-free issue re

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References