Executive brief
A vulnerability exists in the Linux kernel's ROSE networking protocol implementation, which is used for amateur radio packet networking. When a network device is disabled, the system may incorrectly access memory, potentially leading to a system crash or unauthorized access to sensitive information. This could allow a local user to disrupt operations or compromise the integrity of the system.
Technical details
A vulnerability in the Linux kernel's ROSE (X.25 PLP) networking layer stems from an incorrect loop index in the rose_kill_by_device() function. The function collects sockets into a local array to disconnect them when a device is brought down, but mistakenly uses the total count (cnt) as an index instead of the loop iterator (i). This results in reading uninitialized memory or an out-of-bounds read if the array is full, leading to invalid socket pointer dereferences and reference count leaks. An attacker with local access could exploit this to cause a kernel panic (DoS) or potentially achieve privilege escalation. Patches have been released across multiple stable kernel branches.
Affected products
- Linux Linux Kernel 64b8bc7d5f143 to 6595beb40fb0ec47223d3f6058ee40354694c8e4
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6
Timeline
- 2025-12-22: disclosed: Initial patch submission by researchers at Purdue University
- 2025-12-30: patched: Mainline kernel patch committed
- 2026-01-13: advisory: CVE published
References
- https://git.kernel.org/stable/c/1418c12cd3bba79dc56b57b61c99efe40f579981
- https://git.kernel.org/stable/c/6595beb40fb0ec47223d3f6058ee40354694c8e4
- https://git.kernel.org/stable/c/819fb41ae54960f66025802400c9d3935eef4042
- https://git.kernel.org/stable/c/92d900aac3a5721fb54f3328f1e089b44a861c38
- https://git.kernel.org/stable/c/9f6185a32496834d6980b168cffcccc2d6b17280
- https://git.kernel.org/stable/c/b409ba9e1e63ccf3ab4cc061e33c1f804183543e
- https://git.kernel.org/stable/c/ed2639414d43ba037f798eaf619e878309310451