Junglewise Threat Intelligence

CVE-2025-39827: Linux Kernel slab-use-after-free in ROSE network protocol

CVE-2025-39827 · Severity: medium · CVSS 5.5 · Published 2025-09-16

Technologies: Linux Kernel, Siemens SIMATIC CN 4100, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Linux, Siemens.

Executive brief

A vulnerability was identified in the Linux kernel's networking component responsible for ROSE amateur radio protocol routing. An attacker could exploit this flaw to cause a system crash or unpredictable behavior by triggering a memory error. This issue primarily affects systems using specialized networking protocols, including certain industrial control products from Siemens.

Technical details

A slab-use-after-free vulnerability exists in net/rose/rose_route.c due to inconsistent reference counting mechanisms. The 'rose_neigh' structure utilized two separate fields ('count' and 'use') to track references from different sources, leading to scenarios where memory could be freed while still in use by 'rose_node' structures. An attacker with local access could trigger this condition during route removal or device-down events. The fix merges these reference counting systems into a single 'refcount_t' management system and ensures proper release of references in rose_rt_free(), rose_rt_device_down(), and rose_clear_route().

Affected products

  • Linux Linux Kernel 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to 4cce478c3e82a5fc788d72adb2f4c4e983997639
  • Siemens SIMATIC CN 4100 before V5.0
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6 and later

Timeline

  • 2025-08-23: disclosed: Initial patch submission by Takamitsu Iwai
  • 2025-09-04: patched: Commits merged into stable trees
  • 2025-09-16: advisory: NVD publication date

References

Related threats