CVE-2025-21718

What it actually does

Race condition in ROSE protocol timers allows slab-use-after-free in rose_timer_expiry by acquiring only socket spinlock without verifying user-thread ownership, enabling read of freed memory from interrupt context.

Why it matters to the business

Kernel memory corruption on systems using the ROSE networking stack can cause crashes, denial of service, or potential local privilege escalation, disrupting specialized network operations with low overall prevalence.

How an attack unfolds

An attacker creates a ROSE socket and triggers concurrent timer expiries from softirq context while user threads manipulate socket state, leading to use-after-free; similar patterns seen in other recent Linux kernel privilege-escalation campaigns.

How to fix it

Upgrade the Linux kernel to a version containing commit 52f5aff33ca73b2c2fa93f40a3de308012e63cf4 or later; rebuild and reboot affected systems; disable ROSE protocol if unused.

How to confirm the fix worked

Verify kernel source contains the timer ownership check in rose_timer.c; run syzkaller or targeted timer-race reproducers; confirm no KASAN reports for rose_timer_expiry after patching.

Typical attack path

1. Create and configure a ROSE socket from user space
2. Manipulate socket ownership and state to race with timers
3. Trigger timer softirq to execute rose_timer_expiry on freed object
4. Read or write through dangling pointer to achieve memory corruption or crash

How to detect it

Search kernel logs and KASAN reports for rose_timer_expiry stack traces; inspect auditd and syscall logs for unusual ROSE socket creation and timer-related activity; correlate with softirq and IRQ exit events.

What your security team should do

• Apply the referenced kernel commit immediately on any system exposing ROSE sockets
• Audit for ROSE protocol usage and restrict to trusted environments only
• Monitor EPSS and KEV updates given 608 days since publication and related kernel exploits
• Test patched kernels in staging before production deployment