CVE-2025-39827

What it actually does

Use-after-free in Linux kernel ROSE protocol implementation caused by separate reference counters ('count' and 'use') for rose_neigh structures; node references were not properly accounted in the refcount, allowing rose_neigh objects to be freed while still referenced by rose_node structures, leading to slab-use-after-free.

Why it matters to the business

Local denial of service on Linux systems using the ROSE amateur radio protocol stack; systems may experience kernel crashes or instability under specific local workloads, with low but non-zero exploitation probability indicated by EPSS trend.

How an attack unfolds

An attacker with local access creates ROSE sockets or routes that increment node references, then triggers path cleanup routines (rose_rt_free, rose_rt_device_down, rose_clear_route) that release references prematurely; this frees the rose_neigh object while rose_node still holds a pointer, resulting in use-after-free when the structure is later accessed. Threat actors such as VMSCAPE have targeted similar Linux kernel reference-counting issues for privilege escalation on container-optimized OSes.

How to fix it

Upgrade Linux kernel to commit 4cce478c3e82a5fc788d72adb2f4c4e983997639 or later. For Debian xaos packages on versions 11-14, upgrade to 3.1r-4. Reboot after kernel update and verify ROSE protocol usage is no longer required or is properly isolated.

How to confirm the fix worked

Confirm kernel version contains commit 4cce478c3e82a5fc788d72adb2f4c4e983997639; run 'uname -r' and cross-check against fixed git hash; test ROSE socket creation and route teardown under Syzbot-style fuzzing to ensure no slab-use-after-free occurs.

Typical attack path

1. Obtain local unprivileged access to a Linux system with ROSE protocol enabled
2. Create rose_sock and rose_node structures to increment rose_neigh references
3. Trigger device down or route removal events to call reference-release paths without proper refcount adjustment
4. Access the now-freed rose_neigh slab object through remaining node pointers to trigger use-after-free
5. Crash the kernel or attempt to leverage the freed memory for further exploitation

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for slab-use-after-free or rose_neigh related oops/panic messages; inspect process creation of rose sockets via audit logs; correlate with local user activity around network route changes. No widespread in-the-wild exploitation indicators reported.

What your security team should do

• Prioritize kernel upgrade on any systems exposing ROSE protocol or running affected stable trees
• Disable ROSE protocol modules (rose.ko) via modprobe blacklist if not required
• Monitor EPSS score and threat actor activity around similar container kernel reference-count bugs
• Apply the fix within standard patch windows; no KEV listing reduces immediate external urgency but local risk remains