Race Condition Vulnerability in Linux Kernel Affecting Refcount in ROSE Network Protocol

CVE-2025-39826

What is CVE-2025-39826?

A vulnerability exists in the Linux kernel's ROSE protocol implementation that can lead to race conditions. The misuse of the 'use' field in the struct rose_neigh—designed as a reference counter—creates a situation where the structure may be deallocated while still being in use by other code paths. This mismanagement can result in use-after-free scenarios, particularly during ioctl operations where the reference count unexpectedly drops to zero. The vulnerability has been addressed by enhancing the atomicity of the reference count, converting the 'use' field from an unsigned short to a refcount_t type, and implementing safer reference management functions.

References