{"uuid": "2443ccf5-2af0-48cf-9a84-69ded62068cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-21792", "type": "seen", "source": "https://t.me/cvedetector/18998", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-21792 - Linux Kernel AX25 SO_BINDTODEVICE Refcount Leak Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2025-21792 \nPublished : Feb. 27, 2025, 3:15 a.m. | 1\u00a0hour, 54\u00a0minutes ago \nDescription : In the Linux kernel, the following vulnerability has been resolved:  \n  \nax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt  \n  \nIf an AX25 device is bound to a socket by setting the SO_BINDTODEVICE  \nsocket option, a refcount leak will occur in ax25_release().  \n  \nCommit 9fd75b66b8f6 (\"ax25: Fix refcount leaks caused by ax25_cb_del()\")  \nadded decrement of device refcounts in ax25_release(). In order for that  \nto work correctly the refcounts must already be incremented when the  \ndevice is bound to the socket. An AX25 device can be bound to a socket  \nby either calling ax25_bind() or setting SO_BINDTODEVICE socket option.  \nIn both cases the refcounts should be incremented, but in fact it is done  \nonly in ax25_bind().  \n  \nThis bug leads to the following issue reported by Syzkaller:  \n  \n================================================================  \nrefcount_t: decrement hit 0; leaking memory.  \nWARNING: CPU: 1 PID: 5932 at lib/refcount.c:31 refcount_warn_saturate+0x1ed/0x210 lib/refcount.c:31  \nModules linked in:  \nCPU: 1 UID: 0 PID: 5932 Comm: syz-executor424 Not tainted 6.13.0-rc4-syzkaller-00110-g4099a71718b0 #0  \nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014  \nRIP: 0010:refcount_warn_saturate+0x1ed/0x210 lib/refcount.c:31  \nCall Trace:  \n   \n __refcount_dec include/linux/refcount.h:336 [inline]  \n refcount_dec include/linux/refcount.h:351 [inline]  \n ref_tracker_free+0x710/0x820 lib/ref_tracker.c:236  \n netdev_tracker_free include/linux/netdevice.h:4156 [inline]  \n netdev_put include/linux/netdevice.h:4173 [inline]  \n netdev_put include/linux/netdevice.h:4169 [inline]  \n ax25_release+0x33f/0xa10 net/ax25/af_ax25.c:1069  \n __sock_release+0xb0/0x270 net/socket.c:640  \n sock_close+0x1c/0x30 net/socket.c:1408  \n ...  \n do_syscall_x64 arch/x86/entry/common.c:52 [inline]  \n do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83  \n entry_SYSCALL_64_after_hwframe+0x77/0x7f  \n ...  \n   \n================================================================  \n  \nFix the implementation of ax25_setsockopt() by adding increment of  \nrefcounts for the new device bound, and decrement of refcounts for  \nthe old unbound device. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"27 Feb 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-02-27T06:11:20.000000Z"}