8.8
Élevée
CVE-2025-39826 In the Linux kernel, the following vulnerability has been resolved: net: rose: convert 'use' field to refcount_t The…
Description
In the Linux kernel, the following vulnerability has been resolved: net: rose: convert 'use' field to refcount_t The 'use' field in struct rose_neigh is used as a reference counter but lacks atomicity. This can lead to race conditions where a rose_neigh structure is freed while still being referenced by other code paths. For example, when rose_neigh->use becomes zero during an ioctl operation via rose_rt_ioctl(), the structure may be removed while its timer is still active, potentially causing use-after-free issues. This patch changes the type of 'use' from unsigned short to refcount_t and updates all code paths to use rose_neigh_hold() and rose_neigh_put() which operate reference counts atomically.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Linux 6.17 | premières → < 6.17 | 6.17 |
| Linux 6.16 | premières → < 6.16.5 | 6.16.5 |
| Linux 6.12 | premières → < 6.12.45 | 6.12.45 |
| Linux 6.6 | premières → < 6.6.104 | 6.6.104 |
| Linux 6.1 | premières → < 6.1.150 | 6.1.150 |
| Linux | 2.6.12 | Pas de correctif indiqué |
| SIMATIC CN 4100 5.0 | premières → < 5.0 | 5.0 |
| SIMATIC S7-1500 CPU 1518-4 PN/DP MFP 3.1 | 3.1.7 → dernières | Pas de correctif indiqué |
| SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP 3.1 | 3.1.7 → dernières | Pas de correctif indiqué |
Afficher l’autre branche Masquer l’autre branche
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| SIPLUS S7-1500 CPU 1518-4 PN/DP MFP 3.1 | 3.1.7 → dernières | Pas de correctif indiqué |
Références
- git.kernel.org git.kernel.org
- git.kernel.org git.kernel.org
- git.kernel.org git.kernel.org
- git.kernel.org git.kernel.org
- git.kernel.org git.kernel.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de Linux
Les 18283 CVE de Linux →
CVE-2026-99270
In the Linux kernel, the following vulnerability has been resolved:
tcp: Fix potential UAF in reqsk_timer_handler()
8.1
Élevée
CVE-2026-99269
In the Linux kernel, the following vulnerability has been resolved: sched_ext: Wait for SCX_OPSS_DISPATCHING before…
7.8
Élevée
CVE-2026-99261
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: correct reservation fence slots for…
Non notée
CVE-2026-99260
In the Linux kernel, the following vulnerability has been resolved: ntfs: fix resident conversion in ntfs_new_attr_flags…
Non notée