net: rose: convert 'use' field to refcount_t
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.1.150, 6.6.104, 6.12.45, 6.16.5
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: net: rose: convert 'use' field to refcount_t The 'use' field in struct rose_neigh is used as a reference counter but lacks atomicity. This can lead to race conditions where a rose_neigh structure is freed while still being referenced by other code paths. For example, when rose_neigh->use becomes zero during an ioctl operation via rose_rt_ioctl(), the structure may be removed while its timer is still active, potentially causing use-after-free issues. This patch changes the type of 'use' from unsigned short to refcount_t and updates all code paths to use rose_neigh_hold() and rose_neigh_put() which operate reference counts atomically.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 · fixed in fb07156cc0742ba4e93dfcc84280c011d05b301f; From 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 · fixed in f8c29fc437d03a98fb075c31c5be761cc8326284; From 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 · fixed in 0085b250fcc79f900c82a69980ec2f3e1871823b; From 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 · fixed in 203e4f42596ede31498744018716a3db6dbb7f51; From 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 · fixed in d860d1faa6b2ce3becfdb8b0c2b048ad31800061
- Linux Linux
2.6.12
- KernelLinux
From 2.6.12 · fixed in 6.1.150; From 6.2.0 · fixed in 6.6.104; From 6.7.0 · fixed in 6.12.45; From 6.13.0 · fixed in 6.16.5