CVE-2025-39826

What it actually does

Non-atomic reference counter in struct rose_neigh allows races that free the structure while timers or other paths still hold references, resulting in use-after-free.

Why it matters to the business

Local attackers on affected Linux systems may crash the kernel or escalate privileges, disrupting network services that rely on the ROSE protocol and requiring urgent patching of production kernels.

How an attack unfolds

An attacker with local access triggers rose_rt_ioctl() to drive the reference count to zero while a timer remains active, freeing the rose_neigh object; subsequent timer callbacks then access the freed memory. Threat actors such as VMSCAPE and campaigns targeting container-optimized OS kernels have demonstrated similar kernel reference-counting flaws.

How to fix it

Upgrade the Linux kernel to commit fb07156cc0742ba4e93dfcc84280c011d05b301f or later; apply the refcount_t conversion and ensure all call sites use rose_neigh_hold/put. Rebuild and reboot with the fixed kernel. For Debian-packaged openssl entries, update to 0.9.7c or newer as applicable.

How to confirm the fix worked

Confirm the running kernel contains commit fb07156cc0742ba4e93dfcc84280c011d05b301f; inspect struct rose_neigh to verify the 'use' field is now refcount_t and that rose_neigh_hold/put are used consistently; run kernel regression tests exercising rose_rt_ioctl and timers.

Typical attack path

1. Obtain local user access on a system running a vulnerable kernel with ROSE support enabled
2. Invoke rose_rt_ioctl() to manipulate rose_neigh reference counts
3. Trigger concurrent timer or network paths that retain stale references
4. Cause the structure to be freed while still referenced
5. Execute use-after-free to corrupt kernel memory or redirect execution

How to detect it

Review kernel logs for rose_neigh-related oops or slab-use-after-free warnings; search audit logs for unusual rose_rt_ioctl calls; correlate with process activity on container-optimized hosts where similar privilege-escalation techniques have been observed.

What your security team should do

• Prioritize kernel upgrades on all systems exposing ROSE or AX.25 networking within the next 30 days given the 406-day publication window
• Audit custom kernels and container host images for the vulnerable rose_neigh implementation
• Restrict unprivileged local access on systems where ROSE is compiled in until patches are applied
• Monitor EPSS trend and any new exploit maturity signals for this class of reference-counting flaw