net: rose: fix invalid array index in rose_kill_by_device()

Summary

In the Linux kernel, the following vulnerability has been resolved: net: rose: fix invalid array index in rose_kill_by_device() rose_kill_by_device() collects sockets into a local array[] and then iterates over them to disconnect sockets bound to a device being brought down. The loop mistakenly indexes array[cnt] instead of array[i]. For cnt < ARRAY_SIZE(array), this reads an uninitialized entry; for cnt == ARRAY_SIZE(array), it is an out-of-bounds read. Either case can lead to an invalid socket pointer dereference and also leaks references taken via sock_hold(). Fix the index to use i.

Timeline

1. Jan 13, 2026, 3:34 PM UTCCVE published
2. Oct 15, 2026, 1:10 AM UTCRecord last updated

Affected versions

• Linux Linux

  From 12e5a4719c99d7f4104e7e962393dfb8baa1c591 · fixed in 819fb41ae54960f66025802400c9d3935eef4042; From c0e527c532a07556ca44642f5873b002c44da22c · fixed in ed2639414d43ba037f798eaf619e878309310451; From 3e0d1585799d8a991eba9678f297fd78d9f1846e · fixed in 1418c12cd3bba79dc56b57b61c99efe40f579981; From ffced26692f83212aa09d0ece0213b23cc2f611d · fixed in 9f6185a32496834d6980b168cffcccc2d6b17280; From 64b8bc7d5f1434c636a40bdcfcd42b278d1714be · fixed in b409ba9e1e63ccf3ab4cc061e33c1f804183543e; From 64b8bc7d5f1434c636a40bdcfcd42b278d1714be · fixed in 92d900aac3a5721fb54f3328f1e089b44a861c38; From 64b8bc7d5f1434c636a40bdcfcd42b278d1714be · fixed in 6595beb40fb0ec47223d3f6058ee40354694c8e4; From 5.10.206 · fixed in 5.10.248; From 5.15.146 · fixed in 5.15.198; From 6.1.70 · fixed in 6.1.160; From 6.6.9 · fixed in 6.6.120; From 4.19.304 · fixed in 4.20; From 5.4.266 · fixed in 5.5

• Linux Linux

  6.7

• KernelLinux

  fixed in 5.10.248; From 5.11.0 · fixed in 5.15.198; From 5.16.0 · fixed in 6.1.160; From 6.2.0 · fixed in 6.6.120; From 6.7.0 · fixed in 6.12.64; fixed in 6.18.4

References 7