Linux Kernel Vulnerability in Rose Timers Affecting Google Compute Engine

CVE-2025-21718

Summary

A vulnerability in the Linux kernel's rose timer functionality allows potential race conditions against user threads, which may lead to a use-after-free error. The issue occurs when rose timers only acquire a socket spinlock without checking the ownership of the socket. This oversight can be exploited, particularly under conditions of concurrent access, leading to unexpected behavior and possible instability in applications relying on rose timers.

References