CVE-2025-21792 (GCVE-0-2025-21792)

Vulnerability from cvelistv5 – Published: 2025-02-27 02:18 – Updated: 2026-08-05 11:54
VLAI
Title
ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt
Summary
In the Linux kernel, the following vulnerability has been resolved: ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt If an AX25 device is bound to a socket by setting the SO_BINDTODEVICE socket option, a refcount leak will occur in ax25_release(). Commit 9fd75b66b8f6 ("ax25: Fix refcount leaks caused by ax25_cb_del()") added decrement of device refcounts in ax25_release(). In order for that to work correctly the refcounts must already be incremented when the device is bound to the socket. An AX25 device can be bound to a socket by either calling ax25_bind() or setting SO_BINDTODEVICE socket option. In both cases the refcounts should be incremented, but in fact it is done only in ax25_bind(). This bug leads to the following issue reported by Syzkaller: ================================================================ refcount_t: decrement hit 0; leaking memory. WARNING: CPU: 1 PID: 5932 at lib/refcount.c:31 refcount_warn_saturate+0x1ed/0x210 lib/refcount.c:31 Modules linked in: CPU: 1 UID: 0 PID: 5932 Comm: syz-executor424 Not tainted 6.13.0-rc4-syzkaller-00110-g4099a71718b0 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:refcount_warn_saturate+0x1ed/0x210 lib/refcount.c:31 Call Trace: <TASK> __refcount_dec include/linux/refcount.h:336 [inline] refcount_dec include/linux/refcount.h:351 [inline] ref_tracker_free+0x710/0x820 lib/ref_tracker.c:236 netdev_tracker_free include/linux/netdevice.h:4156 [inline] netdev_put include/linux/netdevice.h:4173 [inline] netdev_put include/linux/netdevice.h:4169 [inline] ax25_release+0x33f/0xa10 net/ax25/af_ax25.c:1069 __sock_release+0xb0/0x270 net/socket.c:640 sock_close+0x1c/0x30 net/socket.c:1408 ... do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f ... </TASK> ================================================================ Fix the implementation of ax25_setsockopt() by adding increment of refcounts for the new device bound, and decrement of refcounts for the old unbound device.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-01 19:29 UTC
CWE
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 6641 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 9fd75b66b8f68498454d685dc4ba13192ae069b0 , < 90056ece99966182dc0e367f3fd2afab46ada847 (git)
Affected: 9fd75b66b8f68498454d685dc4ba13192ae069b0 , < 94a0de224ed52eb2ecd4f4cb1b937b674c9fb955 (git)
Affected: 9fd75b66b8f68498454d685dc4ba13192ae069b0 , < b58f7ca86a7b8e480c06e30c5163c5d2f4e24023 (git)
Affected: 9fd75b66b8f68498454d685dc4ba13192ae069b0 , < 470bda72fda0fcf54300466d70ce2de62f7835d2 (git)
Affected: 9fd75b66b8f68498454d685dc4ba13192ae069b0 , < bca0902e61731a75fc4860c8720168d9f1bae3b6 (git)
Affected: c44a453ffe16eb08acdc6129ac4fa0192dbc0456 (git)
Affected: de55a1338e6a48ff1e41ea8db1432496fbe2a62b (git)
Affected: 9e1e088a57c23251f1cfe9601bbd90ade2ea73b9 (git)
Affected: b20a5ab0f5fb175750c6bafd4cf12daccf00c738 (git)
Affected: 452ae92b99062d2f6a34324eaf705a3b7eac9f8b (git)
Affected: 534156dd4ed768e30a43de0036f45dca7c54818f (git)
Affected: 4.14.277 , < 4.15 (semver)
Affected: 4.19.240 , < 4.20 (semver)
Affected: 5.4.190 , < 5.5 (semver)
Affected: 5.10.112 , < 5.11 (semver)
Affected: 5.15.35 , < 5.16 (semver)
Affected: 5.17.2 , < 5.18 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.18
Unaffected: 0 , < 5.18 (semver)
Unaffected: 6.1.129 , ≤ 6.1.* (semver)
Unaffected: 6.6.79 , ≤ 6.6.* (semver)
Unaffected: 6.12.16 , ≤ 6.12.* (semver)
Unaffected: 6.13.4 , ≤ 6.13.* (semver)
Unaffected: 6.14 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-21792",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:29:51.044536Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T19:36:39.465Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:59:36.026Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ax25/af_ax25.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "90056ece99966182dc0e367f3fd2afab46ada847",
              "status": "affected",
              "version": "9fd75b66b8f68498454d685dc4ba13192ae069b0",
              "versionType": "git"
            },
            {
              "lessThan": "94a0de224ed52eb2ecd4f4cb1b937b674c9fb955",
              "status": "affected",
              "version": "9fd75b66b8f68498454d685dc4ba13192ae069b0",
              "versionType": "git"
            },
            {
              "lessThan": "b58f7ca86a7b8e480c06e30c5163c5d2f4e24023",
              "status": "affected",
              "version": "9fd75b66b8f68498454d685dc4ba13192ae069b0",
              "versionType": "git"
            },
            {
              "lessThan": "470bda72fda0fcf54300466d70ce2de62f7835d2",
              "status": "affected",
              "version": "9fd75b66b8f68498454d685dc4ba13192ae069b0",
              "versionType": "git"
            },
            {
              "lessThan": "bca0902e61731a75fc4860c8720168d9f1bae3b6",
              "status": "affected",
              "version": "9fd75b66b8f68498454d685dc4ba13192ae069b0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c44a453ffe16eb08acdc6129ac4fa0192dbc0456",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "de55a1338e6a48ff1e41ea8db1432496fbe2a62b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9e1e088a57c23251f1cfe9601bbd90ade2ea73b9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b20a5ab0f5fb175750c6bafd4cf12daccf00c738",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "452ae92b99062d2f6a34324eaf705a3b7eac9f8b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "534156dd4ed768e30a43de0036f45dca7c54818f",
              "versionType": "git"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.277",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.240",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.190",
              "versionType": "semver"
            },
            {
              "lessThan": "5.11",
              "status": "affected",
              "version": "5.10.112",
              "versionType": "semver"
            },
            {
              "lessThan": "5.16",
              "status": "affected",
              "version": "5.15.35",
              "versionType": "semver"
            },
            {
              "lessThan": "5.18",
              "status": "affected",
              "version": "5.17.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ax25/af_ax25.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.129",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.79",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.129",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.79",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.16",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.4",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.277",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.240",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.190",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.10.112",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.15.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.17.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt\n\nIf an AX25 device is bound to a socket by setting the SO_BINDTODEVICE\nsocket option, a refcount leak will occur in ax25_release().\n\nCommit 9fd75b66b8f6 (\"ax25: Fix refcount leaks caused by ax25_cb_del()\")\nadded decrement of device refcounts in ax25_release(). In order for that\nto work correctly the refcounts must already be incremented when the\ndevice is bound to the socket. An AX25 device can be bound to a socket\nby either calling ax25_bind() or setting SO_BINDTODEVICE socket option.\nIn both cases the refcounts should be incremented, but in fact it is done\nonly in ax25_bind().\n\nThis bug leads to the following issue reported by Syzkaller:\n\n================================================================\nrefcount_t: decrement hit 0; leaking memory.\nWARNING: CPU: 1 PID: 5932 at lib/refcount.c:31 refcount_warn_saturate+0x1ed/0x210 lib/refcount.c:31\nModules linked in:\nCPU: 1 UID: 0 PID: 5932 Comm: syz-executor424 Not tainted 6.13.0-rc4-syzkaller-00110-g4099a71718b0 #0\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\nRIP: 0010:refcount_warn_saturate+0x1ed/0x210 lib/refcount.c:31\nCall Trace:\n \u003cTASK\u003e\n __refcount_dec include/linux/refcount.h:336 [inline]\n refcount_dec include/linux/refcount.h:351 [inline]\n ref_tracker_free+0x710/0x820 lib/ref_tracker.c:236\n netdev_tracker_free include/linux/netdevice.h:4156 [inline]\n netdev_put include/linux/netdevice.h:4173 [inline]\n netdev_put include/linux/netdevice.h:4169 [inline]\n ax25_release+0x33f/0xa10 net/ax25/af_ax25.c:1069\n __sock_release+0xb0/0x270 net/socket.c:640\n sock_close+0x1c/0x30 net/socket.c:1408\n ...\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n ...\n \u003c/TASK\u003e\n================================================================\n\nFix the implementation of ax25_setsockopt() by adding increment of\nrefcounts for the new device bound, and decrement of refcounts for\nthe old unbound device."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is triggered entirely through local syscalls \u2014 `socket(AF_AX25, SOCK_DGRAM, 0)`, `setsockopt(SOL_AX25, SO_BINDTODEVICE, ...)`, and `close()`. No network packet or remote peer input is involved in reaching the faulty refcount path.\nAC:L - The underflow is fully deterministic \u2014 every socket bound via SO_BINDTODEVICE and then closed drops two references it never took, with no race to win and no memory layout the attacker cannot influence. The cycle can be repeated arbitrarily to drive `ax25_dev-\u003erefcount` to zero on demand and then groom the freed slab.\nPR:L - Creating an AF_AX25 SOCK_DGRAM socket and setting SO_BINDTODEVICE require no capabilities at all \u2014 the only `capable(CAP_NET_RAW)` check in `ax25_create()` guards SOCK_RAW. On any system with AX.25 already configured (packet-radio node, APRS igate, embedded radio gateway), an ordinary unprivileged user can trigger it.\nUI:N - The attacker performs the entire sequence in their own process; no victim action, mount, or file open is needed. Closing the socket is what fires the erroneous `netdev_put()`/`ax25_dev_put()`.\nS:U - The corrupted refcounts and freed objects (`struct ax25_dev`, `struct net_device`) live in the kernel, and exploitation yields kernel-level compromise within the same security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The premature `kfree_rcu()` of `ax25_dev` leaves `dev-\u003eax25_ptr` dangling and read by `ax25_rcv()`, `ax25_out.c`, and `ax25_ip_xmit()`, so reallocated slab contents are read back as `values[]`, `forward`, and `sysheader`. A use-after-free of this shape gives the attacker a path to disclose arbitrary kernel memory.\nI:H - After the underflow frees `ax25_dev`, the attacker can spray the slab and control `struct net_device *forward` (used as a transmit target by `ax25_fwd_dev()`), `sysheader`, and the DAMA `timer_list`, yielding write and control-flow-hijack primitives. The parallel `net_device` refcount underflow lets `unregister_netdevice()` free a netdev still in use.\nA:H - The immediate observable is a `refcount_warn_saturate` WARN followed by dereference of freed memory in the AX.25 receive and transmit paths, i.e. kernel oops/panic. Any unprivileged user can repeat the trigger to reliably crash the machine."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:54:29.234Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/90056ece99966182dc0e367f3fd2afab46ada847"
        },
        {
          "url": "https://git.kernel.org/stable/c/94a0de224ed52eb2ecd4f4cb1b937b674c9fb955"
        },
        {
          "url": "https://git.kernel.org/stable/c/b58f7ca86a7b8e480c06e30c5163c5d2f4e24023"
        },
        {
          "url": "https://git.kernel.org/stable/c/470bda72fda0fcf54300466d70ce2de62f7835d2"
        },
        {
          "url": "https://git.kernel.org/stable/c/bca0902e61731a75fc4860c8720168d9f1bae3b6"
        }
      ],
      "title": "ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21792",
    "datePublished": "2025-02-27T02:18:29.653Z",
    "dateReserved": "2024-12-29T08:45:45.767Z",
    "dateUpdated": "2026-08-05T11:54:29.234Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-21792",
      "date": "2026-11-11",
      "epss": "0.00241",
      "percentile": "0.15396"
    },
    "microsoft_vex": {
      "current_release_date": "2026-03-31T14:53:35.000Z",
      "cve": "CVE-2025-21792",
      "id": "msrc_CVE-2025-21792",
      "initial_release_date": "2025-02-02T00:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "product_status:under_investigation": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-21792.json",
      "version": "3"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/ax25/af_ax25.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "90056ece99966182dc0e367f3fd2afab46ada847",
                    "status": "affected",
                    "version": "9fd75b66b8f68498454d685dc4ba13192ae069b0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "94a0de224ed52eb2ecd4f4cb1b937b674c9fb955",
                    "status": "affected",
                    "version": "9fd75b66b8f68498454d685dc4ba13192ae069b0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b58f7ca86a7b8e480c06e30c5163c5d2f4e24023",
                    "status": "affected",
                    "version": "9fd75b66b8f68498454d685dc4ba13192ae069b0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "470bda72fda0fcf54300466d70ce2de62f7835d2",
                    "status": "affected",
                    "version": "9fd75b66b8f68498454d685dc4ba13192ae069b0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bca0902e61731a75fc4860c8720168d9f1bae3b6",
                    "status": "affected",
                    "version": "9fd75b66b8f68498454d685dc4ba13192ae069b0",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "c44a453ffe16eb08acdc6129ac4fa0192dbc0456",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "de55a1338e6a48ff1e41ea8db1432496fbe2a62b",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "9e1e088a57c23251f1cfe9601bbd90ade2ea73b9",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "b20a5ab0f5fb175750c6bafd4cf12daccf00c738",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "452ae92b99062d2f6a34324eaf705a3b7eac9f8b",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "534156dd4ed768e30a43de0036f45dca7c54818f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4.15",
                    "status": "affected",
                    "version": "4.14.277",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "4.20",
                    "status": "affected",
                    "version": "4.19.240",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.5",
                    "status": "affected",
                    "version": "5.4.190",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.11",
                    "status": "affected",
                    "version": "5.10.112",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.16",
                    "status": "affected",
                    "version": "5.15.35",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.18",
                    "status": "affected",
                    "version": "5.17.2",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/ax25/af_ax25.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.18"
                  },
                  {
                    "lessThan": "5.18",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.129",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.79",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.16",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.13.*",
                    "status": "unaffected",
                    "version": "6.13.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.14",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "26F3B000-E328-48CE-9B1E-68E0DFD0A909",
                    "versionEndExcluding": "4.15",
                    "versionStartIncluding": "4.14.277",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "36C10971-E218-4588-B691-A4A3534A3B58",
                    "versionEndExcluding": "4.20",
                    "versionStartIncluding": "4.19.240",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "38031C07-F0BC-442A-A08F-FB9B732F2CA5",
                    "versionEndExcluding": "5.5",
                    "versionStartIncluding": "5.4.190",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E1C7F59E-6FCD-4163-9D36-1585FB5A71E7",
                    "versionEndExcluding": "5.11",
                    "versionStartIncluding": "5.10.112",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5DFF4167-1962-4F68-81DD-C3D56FE88E76",
                    "versionEndExcluding": "5.16",
                    "versionStartIncluding": "5.15.35",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "EB2089C3-1FFD-4729-9C94-A45890155918",
                    "versionEndExcluding": "6.1.129",
                    "versionStartIncluding": "5.17.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B16AADE5-B2FD-4C14-B4E4-85E8EDAFE775",
                    "versionEndExcluding": "6.6.79",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "13C8DB18-FC60-425F-84E5-3EDDEC61B2FC",
                    "versionEndExcluding": "6.12.16",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2A2093ED-74A9-43F9-AC72-50030F374EA4",
                    "versionEndExcluding": "6.13.4",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "186716B6-2B66-4BD0-852E-D48E71C0C85F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "0D3E781C-403A-498F-9DA9-ECEE50F41E75",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt\n\nIf an AX25 device is bound to a socket by setting the SO_BINDTODEVICE\nsocket option, a refcount leak will occur in ax25_release().\n\nCommit 9fd75b66b8f6 (\"ax25: Fix refcount leaks caused by ax25_cb_del()\")\nadded decrement of device refcounts in ax25_release(). In order for that\nto work correctly the refcounts must already be incremented when the\ndevice is bound to the socket. An AX25 device can be bound to a socket\nby either calling ax25_bind() or setting SO_BINDTODEVICE socket option.\nIn both cases the refcounts should be incremented, but in fact it is done\nonly in ax25_bind().\n\nThis bug leads to the following issue reported by Syzkaller:\n\n================================================================\nrefcount_t: decrement hit 0; leaking memory.\nWARNING: CPU: 1 PID: 5932 at lib/refcount.c:31 refcount_warn_saturate+0x1ed/0x210 lib/refcount.c:31\nModules linked in:\nCPU: 1 UID: 0 PID: 5932 Comm: syz-executor424 Not tainted 6.13.0-rc4-syzkaller-00110-g4099a71718b0 #0\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\nRIP: 0010:refcount_warn_saturate+0x1ed/0x210 lib/refcount.c:31\nCall Trace:\n \u003cTASK\u003e\n __refcount_dec include/linux/refcount.h:336 [inline]\n refcount_dec include/linux/refcount.h:351 [inline]\n ref_tracker_free+0x710/0x820 lib/ref_tracker.c:236\n netdev_tracker_free include/linux/netdevice.h:4156 [inline]\n netdev_put include/linux/netdevice.h:4173 [inline]\n netdev_put include/linux/netdevice.h:4169 [inline]\n ax25_release+0x33f/0xa10 net/ax25/af_ax25.c:1069\n __sock_release+0xb0/0x270 net/socket.c:640\n sock_close+0x1c/0x30 net/socket.c:1408\n ...\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n ...\n \u003c/TASK\u003e\n================================================================\n\nFix the implementation of ax25_setsockopt() by adding increment of\nrefcounts for the new device bound, and decrement of refcounts for\nthe old unbound device."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt Si un dispositivo AX25 est\u00e1 enlazado a un socket configurando la opci\u00f3n de socket SO_BINDTODEVICE, se producir\u00e1 una p\u00e9rdida de refcount en ax25_release(). el commit 9fd75b66b8f6 (\"ax25: Fix refcount leaks caused by ax25_cb_del()\") a\u00f1adi\u00f3 una disminuci\u00f3n de los refcounts del dispositivo en ax25_release(). Para que funcione correctamente, los refcounts ya deben estar incrementados cuando el dispositivo est\u00e1 enlazado al socket. Un dispositivo AX25 puede estar enlazado a un socket llamando a ax25_bind() o configurando la opci\u00f3n de socket SO_BINDTODEVICE. En ambos casos, los refcounts deben incrementarse, pero de hecho solo se hace en ax25_bind(). Este error conduce al siguiente problema informado por Syzkaller: ================================================================= refcount_t: el decremento lleg\u00f3 a 0; p\u00e9rdida de memoria. ADVERTENCIA: CPU: 1 PID: 5932 en lib/refcount.c:31 refcount_warn_saturate+0x1ed/0x210 lib/refcount.c:31 M\u00f3dulos vinculados: CPU: 1 UID: 0 PID: 5932 Comm: syz-executor424 No contaminado 6.13.0-rc4-syzkaller-00110-g4099a71718b0 #0 Nombre del hardware: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:refcount_warn_saturate+0x1ed/0x210 lib/refcount.c:31 Seguimiento de llamadas:  __refcount_dec include/linux/refcount.h:336 [en l\u00ednea] refcount_dec include/linux/refcount.h:351 [en l\u00ednea] ref_tracker_free+0x710/0x820 lib/ref_tracker.c:236 netdev_tracker_free include/linux/netdevice.h:4156 [en l\u00ednea] netdev_put include/linux/netdevice.h:4173 [en l\u00ednea] netdev_put include/linux/netdevice.h:4169 [en l\u00ednea] ax25_release+0x33f/0xa10 net/ax25/af_ax25.c:1069 __sock_release+0xb0/0x270 net/socket.c:640 sock_close+0x1c/0x30 net/socket.c:1408 ... do_syscall_x64 arch/x86/entry/common.c:52 [en l\u00ednea] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f ...  ================================================================== Corrija la implementaci\u00f3n de ax25_setsockopt() agregando un incremento de recuentos de referencias para el nuevo dispositivo vinculado y una disminuci\u00f3n de recuentos de referencias para el antiguo dispositivo no vinculado."
          }
        ],
        "id": "CVE-2025-21792",
        "lastModified": "2026-07-30T06:21:31.303",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-21792",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:29:51.044536Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-02-27T03:15:20.080",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Mailing List",
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/470bda72fda0fcf54300466d70ce2de62f7835d2"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Mailing List",
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/90056ece99966182dc0e367f3fd2afab46ada847"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Mailing List",
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/94a0de224ed52eb2ecd4f4cb1b937b674c9fb955"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Mailing List",
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/b58f7ca86a7b8e480c06e30c5163c5d2f4e24023"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Mailing List",
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/bca0902e61731a75fc4860c8720168d9f1bae3b6"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-Other"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-11-09T17:36:34+00:00",
      "cve": "CVE-2025-21792",
      "id": "CVE-2025-21792",
      "initial_release_date": "2025-02-27T00:00:00+00:00",
      "product_status:known_not_affected": "200",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-21792.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2025-11-03T20:59:36.026Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "LOCAL",
                  "availabilityImpact": "HIGH",
                  "baseScore": 5.5,
                  "baseSeverity": "MEDIUM",
                  "confidentialityImpact": "NONE",
                  "integrityImpact": "NONE",
                  "privilegesRequired": "LOW",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-21792",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-10-01T19:29:51.044536Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "description": "CWE-noinfo Not enough information",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-10-01T16:56:27.760Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "net/ax25/af_ax25.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "90056ece99966182dc0e367f3fd2afab46ada847",
                  "status": "affected",
                  "version": "9fd75b66b8f68498454d685dc4ba13192ae069b0",
                  "versionType": "git"
                },
                {
                  "lessThan": "94a0de224ed52eb2ecd4f4cb1b937b674c9fb955",
                  "status": "affected",
                  "version": "9fd75b66b8f68498454d685dc4ba13192ae069b0",
                  "versionType": "git"
                },
                {
                  "lessThan": "b58f7ca86a7b8e480c06e30c5163c5d2f4e24023",
                  "status": "affected",
                  "version": "9fd75b66b8f68498454d685dc4ba13192ae069b0",
                  "versionType": "git"
                },
                {
                  "lessThan": "470bda72fda0fcf54300466d70ce2de62f7835d2",
                  "status": "affected",
                  "version": "9fd75b66b8f68498454d685dc4ba13192ae069b0",
                  "versionType": "git"
                },
                {
                  "lessThan": "bca0902e61731a75fc4860c8720168d9f1bae3b6",
                  "status": "affected",
                  "version": "9fd75b66b8f68498454d685dc4ba13192ae069b0",
                  "versionType": "git"
                },
                {
                  "status": "affected",
                  "version": "c44a453ffe16eb08acdc6129ac4fa0192dbc0456",
                  "versionType": "git"
                },
                {
                  "status": "affected",
                  "version": "de55a1338e6a48ff1e41ea8db1432496fbe2a62b",
                  "versionType": "git"
                },
                {
                  "status": "affected",
                  "version": "9e1e088a57c23251f1cfe9601bbd90ade2ea73b9",
                  "versionType": "git"
                },
                {
                  "status": "affected",
                  "version": "b20a5ab0f5fb175750c6bafd4cf12daccf00c738",
                  "versionType": "git"
                },
                {
                  "status": "affected",
                  "version": "452ae92b99062d2f6a34324eaf705a3b7eac9f8b",
                  "versionType": "git"
                },
                {
                  "status": "affected",
                  "version": "534156dd4ed768e30a43de0036f45dca7c54818f",
                  "versionType": "git"
                },
                {
                  "lessThan": "4.15",
                  "status": "affected",
                  "version": "4.14.277",
                  "versionType": "semver"
                },
                {
                  "lessThan": "4.20",
                  "status": "affected",
                  "version": "4.19.240",
                  "versionType": "semver"
                },
                {
                  "lessThan": "5.5",
                  "status": "affected",
                  "version": "5.4.190",
                  "versionType": "semver"
                },
                {
                  "lessThan": "5.11",
                  "status": "affected",
                  "version": "5.10.112",
                  "versionType": "semver"
                },
                {
                  "lessThan": "5.16",
                  "status": "affected",
                  "version": "5.15.35",
                  "versionType": "semver"
                },
                {
                  "lessThan": "5.18",
                  "status": "affected",
                  "version": "5.17.2",
                  "versionType": "semver"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "net/ax25/af_ax25.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "5.18"
                },
                {
                  "lessThan": "5.18",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.129",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.79",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.12.*",
                  "status": "unaffected",
                  "version": "6.12.16",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.13.*",
                  "status": "unaffected",
                  "version": "6.13.4",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.14",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.129",
                      "versionStartIncluding": "5.18",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.79",
                      "versionStartIncluding": "5.18",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.12.16",
                      "versionStartIncluding": "5.18",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.13.4",
                      "versionStartIncluding": "5.18",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.14",
                      "versionStartIncluding": "5.18",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionStartIncluding": "4.14.277",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionStartIncluding": "4.19.240",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionStartIncluding": "5.4.190",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionStartIncluding": "5.10.112",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionStartIncluding": "5.15.35",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionStartIncluding": "5.17.2",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt\n\nIf an AX25 device is bound to a socket by setting the SO_BINDTODEVICE\nsocket option, a refcount leak will occur in ax25_release().\n\nCommit 9fd75b66b8f6 (\"ax25: Fix refcount leaks caused by ax25_cb_del()\")\nadded decrement of device refcounts in ax25_release(). In order for that\nto work correctly the refcounts must already be incremented when the\ndevice is bound to the socket. An AX25 device can be bound to a socket\nby either calling ax25_bind() or setting SO_BINDTODEVICE socket option.\nIn both cases the refcounts should be incremented, but in fact it is done\nonly in ax25_bind().\n\nThis bug leads to the following issue reported by Syzkaller:\n\n================================================================\nrefcount_t: decrement hit 0; leaking memory.\nWARNING: CPU: 1 PID: 5932 at lib/refcount.c:31 refcount_warn_saturate+0x1ed/0x210 lib/refcount.c:31\nModules linked in:\nCPU: 1 UID: 0 PID: 5932 Comm: syz-executor424 Not tainted 6.13.0-rc4-syzkaller-00110-g4099a71718b0 #0\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\nRIP: 0010:refcount_warn_saturate+0x1ed/0x210 lib/refcount.c:31\nCall Trace:\n \u003cTASK\u003e\n __refcount_dec include/linux/refcount.h:336 [inline]\n refcount_dec include/linux/refcount.h:351 [inline]\n ref_tracker_free+0x710/0x820 lib/ref_tracker.c:236\n netdev_tracker_free include/linux/netdevice.h:4156 [inline]\n netdev_put include/linux/netdevice.h:4173 [inline]\n netdev_put include/linux/netdevice.h:4169 [inline]\n ax25_release+0x33f/0xa10 net/ax25/af_ax25.c:1069\n __sock_release+0xb0/0x270 net/socket.c:640\n sock_close+0x1c/0x30 net/socket.c:1408\n ...\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n ...\n \u003c/TASK\u003e\n================================================================\n\nFix the implementation of ax25_setsockopt() by adding increment of\nrefcounts for the new device bound, and decrement of refcounts for\nthe old unbound device."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - The bug is triggered entirely through local syscalls \u2014 `socket(AF_AX25, SOCK_DGRAM, 0)`, `setsockopt(SOL_AX25, SO_BINDTODEVICE, ...)`, and `close()`. No network packet or remote peer input is involved in reaching the faulty refcount path.\nAC:L - The underflow is fully deterministic \u2014 every socket bound via SO_BINDTODEVICE and then closed drops two references it never took, with no race to win and no memory layout the attacker cannot influence. The cycle can be repeated arbitrarily to drive `ax25_dev-\u003erefcount` to zero on demand and then groom the freed slab.\nPR:L - Creating an AF_AX25 SOCK_DGRAM socket and setting SO_BINDTODEVICE require no capabilities at all \u2014 the only `capable(CAP_NET_RAW)` check in `ax25_create()` guards SOCK_RAW. On any system with AX.25 already configured (packet-radio node, APRS igate, embedded radio gateway), an ordinary unprivileged user can trigger it.\nUI:N - The attacker performs the entire sequence in their own process; no victim action, mount, or file open is needed. Closing the socket is what fires the erroneous `netdev_put()`/`ax25_dev_put()`.\nS:U - The corrupted refcounts and freed objects (`struct ax25_dev`, `struct net_device`) live in the kernel, and exploitation yields kernel-level compromise within the same security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The premature `kfree_rcu()` of `ax25_dev` leaves `dev-\u003eax25_ptr` dangling and read by `ax25_rcv()`, `ax25_out.c`, and `ax25_ip_xmit()`, so reallocated slab contents are read back as `values[]`, `forward`, and `sysheader`. A use-after-free of this shape gives the attacker a path to disclose arbitrary kernel memory.\nI:H - After the underflow frees `ax25_dev`, the attacker can spray the slab and control `struct net_device *forward` (used as a transmit target by `ax25_fwd_dev()`), `sysheader`, and the DAMA `timer_list`, yielding write and control-flow-hijack primitives. The parallel `net_device` refcount underflow lets `unregister_netdevice()` free a netdev still in use.\nA:H - The immediate observable is a `refcount_warn_saturate` WARN followed by dereference of freed memory in the AX.25 receive and transmit paths, i.e. kernel oops/panic. Any unprivileged user can repeat the trigger to reliably crash the machine."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T11:54:29.234Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/90056ece99966182dc0e367f3fd2afab46ada847"
            },
            {
              "url": "https://git.kernel.org/stable/c/94a0de224ed52eb2ecd4f4cb1b937b674c9fb955"
            },
            {
              "url": "https://git.kernel.org/stable/c/b58f7ca86a7b8e480c06e30c5163c5d2f4e24023"
            },
            {
              "url": "https://git.kernel.org/stable/c/470bda72fda0fcf54300466d70ce2de62f7835d2"
            },
            {
              "url": "https://git.kernel.org/stable/c/bca0902e61731a75fc4860c8720168d9f1bae3b6"
            }
          ],
          "title": "ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2025-21792",
        "datePublished": "2025-02-27T02:18:29.653Z",
        "dateReserved": "2024-12-29T08:45:45.767Z",
        "dateUpdated": "2026-08-05T11:54:29.234Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.