CVE-2025-38377 (GCVE-0-2025-38377)

Vulnerability from cvelistv5 – Published: 2025-07-25 12:53 – Updated: 2026-08-05 12:01
VLAI
Title
rose: fix dangling neighbour pointers in rose_rt_device_down()
Summary
In the Linux kernel, the following vulnerability has been resolved: rose: fix dangling neighbour pointers in rose_rt_device_down() There are two bugs in rose_rt_device_down() that can cause use-after-free: 1. The loop bound `t->count` is modified within the loop, which can cause the loop to terminate early and miss some entries. 2. When removing an entry from the neighbour array, the subsequent entries are moved up to fill the gap, but the loop index `i` is still incremented, causing the next entry to be skipped. For example, if a node has three neighbours (A, A, B) with count=3 and A is being removed, the second A is not checked. i=0: (A, A, B) -> (A, B) with count=2 ^ checked i=1: (A, B) -> (A, B) with count=2 ^ checked (B, not A!) i=2: (doesn't occur because i < count is false) This leaves the second A in the array with count=2, but the rose_neigh structure has been freed. Code that accesses these entries assumes that the first `count` entries are valid pointers, causing a use-after-free when it accesses the dangling pointer. Fix both issues by iterating over the array in reverse order with a fixed loop bound. This ensures that all entries are examined and that the removal of an entry doesn't affect subsequent iterations.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 94e0918e39039c47ddceb609500817f7266be756 (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < fe62a35fb1f77f494ed534fc69a9043dc5a30ce1 (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 2b952dbb32fef835756f07ff0cd77efbb836dfea (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < b6b232e16e08c6dc120672b4753392df0d28c1b4 (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 7a1841c9609377e989ec41c16551309ce79c39e4 (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 446ac00b86be1670838e513b643933d78837d8db (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 2c6c82ee074bfcfd1bc978ec45bfea37703d840a (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 34a500caf48c47d5171f4aa1f237da39b07c6157 (git)
Create a notification for this product.
Linux Linux Affected: 2.6.12
Unaffected: 0 , < 2.6.12 (semver)
Unaffected: 5.4.296 , ≤ 5.4.* (semver)
Unaffected: 5.10.240 , ≤ 5.10.* (semver)
Unaffected: 5.15.187 , ≤ 5.15.* (semver)
Unaffected: 6.1.144 , ≤ 6.1.* (semver)
Unaffected: 6.6.97 , ≤ 6.6.* (semver)
Unaffected: 6.12.37 , ≤ 6.12.* (semver)
Unaffected: 6.15.6 , ≤ 6.15.* (semver)
Unaffected: 6.16 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:37:14.330Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/rose/rose_route.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "94e0918e39039c47ddceb609500817f7266be756",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "fe62a35fb1f77f494ed534fc69a9043dc5a30ce1",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "2b952dbb32fef835756f07ff0cd77efbb836dfea",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "b6b232e16e08c6dc120672b4753392df0d28c1b4",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "7a1841c9609377e989ec41c16551309ce79c39e4",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "446ac00b86be1670838e513b643933d78837d8db",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "2c6c82ee074bfcfd1bc978ec45bfea37703d840a",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "34a500caf48c47d5171f4aa1f237da39b07c6157",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/rose/rose_route.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.296",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.240",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.187",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.144",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.37",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.296",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.240",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.187",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.144",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.97",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.37",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.6",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrose: fix dangling neighbour pointers in rose_rt_device_down()\n\nThere are two bugs in rose_rt_device_down() that can cause\nuse-after-free:\n\n1. The loop bound `t-\u003ecount` is modified within the loop, which can\n   cause the loop to terminate early and miss some entries.\n\n2. When removing an entry from the neighbour array, the subsequent entries\n   are moved up to fill the gap, but the loop index `i` is still\n   incremented, causing the next entry to be skipped.\n\nFor example, if a node has three neighbours (A, A, B) with count=3 and A\nis being removed, the second A is not checked.\n\n    i=0: (A, A, B) -\u003e (A, B) with count=2\n          ^ checked\n    i=1: (A, B)    -\u003e (A, B) with count=2\n             ^ checked (B, not A!)\n    i=2: (doesn\u0027t occur because i \u003c count is false)\n\nThis leaves the second A in the array with count=2, but the rose_neigh\nstructure has been freed. Code that accesses these entries assumes that\nthe first `count` entries are valid pointers, causing a use-after-free\nwhen it accesses the dangling pointer.\n\nFix both issues by iterating over the array in reverse order with a fixed\nloop bound. This ensures that all entries are examined and that the removal\nof an entry doesn\u0027t affect subsequent iterations."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The dangling `rose_node-\u003eneighbour[]` entry is consumed by `rose_route_frame()` \u2192 `rose_get_neigh(..., route_frame=1)` while processing ROSE CALL REQUEST frames received from AX.25 peers, so a remote unauthenticated station drives the use-after-free. AX.25 rides radio/KISS TNC links or bpqether (ETH_P_BPQ) on the local Ethernet segment, making the attacker link-adjacent rather than internet-routable.\nAC:L - The poisoned entry arises from ordinary operation \u2014 `rose_add_node()` dedupes neighbours only on callsign+device and ignores the digipeater path, so a node legitimately configured with redundant paths through one neighbour already holds duplicate pointers, and every AX.25 port down cycle then frees the neighbour while leaving it referenced with `count` still positive. Once poisoned the entry persists indefinitely, and each injected CALL REQUEST deterministically dereferences the stale pointer with no race, timing window, or unpredictable memory layout, retryable at will to win the slab spray.\nPR:N - ROSE and AX.25 carry no authentication whatsoever, so a peer injecting frames on the segment needs no credentials to reach `rose_route_frame()`/`rose_get_neigh()` and dereference the freed `rose_neigh`. The same stale pointers are also reachable by any unprivileged local user through `connect()` on an AF_ROSE socket and through the world-readable `/proc/net/rose_nodes`.\nUI:N - Only received frames are required; `rose_route_frame()` runs from softirq on packet receive with no local user opening a file, mounting anything, or taking any other action.\nS:U - The corruption is confined to kernel heap objects within the kernel\u0027s own security authority, with no VM, IOMMU, or sandbox boundary crossed.\nC:H - The freed `rose_neigh` (a ~176-byte kmalloc object in a general-purpose slab that is trivially sprayed from unprivileged userspace or by the attacker\u0027s own skb traffic) is read back through `node-\u003eneighbour[i]-\u003erestarted`, `-\u003enumber`, `-\u003eloopback`, `-\u003edev` and `-\u003edigipeat`, so attacker-groomed data is interpreted as kernel pointers and leaked via `/proc/net/rose_nodes` and observable routing behaviour.\nI:H - The dangling pointer takes write operations directly \u2014 `new_neigh-\u003euse++`, `neigh-\u003erestarted = 0`, `skb_queue_tail(\u0026neigh-\u003equeue, skb)` linking into a reclaimed list head, and `add_timer(\u0026neigh-\u003et0timer)`/`timer_delete(\u0026neigh-\u003eftimer)` on a reclaimed `timer_list` \u2014 while `rose_send_frame()` dereferences an attacker-controlled `neigh-\u003edev` to read `dev-\u003edev_addr` and hands it to `ax25_send_frame()`. Together these give write and list-corruption primitives with plausible control-flow hijack.\nA:H - The freed neighbour is still referenced by the node table and reached on every routing lookup, and its armed `ftimer`/`t0timer` plus the wild `-\u003edev` dereference reliably produce a kernel oops or panic \u2014 as syzbot reproduced \u2014 and the crash can be re-triggered at will by any adjacent peer."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:01:27.739Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/94e0918e39039c47ddceb609500817f7266be756"
        },
        {
          "url": "https://git.kernel.org/stable/c/fe62a35fb1f77f494ed534fc69a9043dc5a30ce1"
        },
        {
          "url": "https://git.kernel.org/stable/c/2b952dbb32fef835756f07ff0cd77efbb836dfea"
        },
        {
          "url": "https://git.kernel.org/stable/c/b6b232e16e08c6dc120672b4753392df0d28c1b4"
        },
        {
          "url": "https://git.kernel.org/stable/c/7a1841c9609377e989ec41c16551309ce79c39e4"
        },
        {
          "url": "https://git.kernel.org/stable/c/446ac00b86be1670838e513b643933d78837d8db"
        },
        {
          "url": "https://git.kernel.org/stable/c/2c6c82ee074bfcfd1bc978ec45bfea37703d840a"
        },
        {
          "url": "https://git.kernel.org/stable/c/34a500caf48c47d5171f4aa1f237da39b07c6157"
        }
      ],
      "title": "rose: fix dangling neighbour pointers in rose_rt_device_down()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38377",
    "datePublished": "2025-07-25T12:53:19.141Z",
    "dateReserved": "2025-04-16T04:51:24.010Z",
    "dateUpdated": "2026-08-05T12:01:27.739Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38377",
      "date": "2026-08-05",
      "epss": "0.0023",
      "percentile": "0.13866"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T02:30:44.000Z",
      "cve": "CVE-2025-38377",
      "id": "msrc_CVE-2025-38377",
      "initial_release_date": "2025-07-02T00:00:00.000Z",
      "product_status:known_not_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "rose: fix dangling neighbour pointers in rose_rt_device_down()",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-38377.json",
      "version": "4"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38377\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-25T13:15:26.780\",\"lastModified\":\"2026-07-30T06:23:11.053\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nrose: fix dangling neighbour pointers in rose_rt_device_down()\\n\\nThere are two bugs in rose_rt_device_down() that can cause\\nuse-after-free:\\n\\n1. The loop bound `t-\u003ecount` is modified within the loop, which can\\n   cause the loop to terminate early and miss some entries.\\n\\n2. When removing an entry from the neighbour array, the subsequent entries\\n   are moved up to fill the gap, but the loop index `i` is still\\n   incremented, causing the next entry to be skipped.\\n\\nFor example, if a node has three neighbours (A, A, B) with count=3 and A\\nis being removed, the second A is not checked.\\n\\n    i=0: (A, A, B) -\u003e (A, B) with count=2\\n          ^ checked\\n    i=1: (A, B)    -\u003e (A, B) with count=2\\n             ^ checked (B, not A!)\\n    i=2: (doesn\u0027t occur because i \u003c count is false)\\n\\nThis leaves the second A in the array with count=2, but the rose_neigh\\nstructure has been freed. Code that accesses these entries assumes that\\nthe first `count` entries are valid pointers, causing a use-after-free\\nwhen it accesses the dangling pointer.\\n\\nFix both issues by iterating over the array in reverse order with a fixed\\nloop bound. This ensures that all entries are examined and that the removal\\nof an entry doesn\u0027t affect subsequent iterations.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: rose: correcci\u00f3n de punteros vecinos colgantes en rose_rt_device_down(). Hay dos errores en rose_rt_device_down() que pueden causar un use-after-free: 1. El l\u00edmite del bucle `t-\u0026gt;count` se modifica dentro del bucle, lo que puede provocar que el bucle termine antes de tiempo y se pierdan algunas entradas. 2. Al eliminar una entrada de la matriz de vecinos, las entradas posteriores se mueven hacia arriba para llenar el espacio vac\u00edo, pero el \u00edndice del bucle `i` a\u00fan se incrementa, lo que hace que se omita la siguiente entrada. Por ejemplo, si un nodo tiene tres vecinos (A, A, B) con count=3 y se est\u00e1 eliminando A, no se comprueba el segundo A. i=0: (A, A, B) -\u0026gt; (A, B) con count=2 ^ comprobado i=1: (A, B) -\u0026gt; (A, B) con count=2 ^ comprobado (\u00a1B, no A!) i=2: (no ocurre porque i \u0026lt; count es falso) Esto deja la segunda A en el array con count=2, pero la estructura rose_neigh se ha liberado. El c\u00f3digo que accede a estas entradas asume que las primeras entradas de `count` son punteros v\u00e1lidos, lo que provoca un use-after-free al acceder al puntero colgante. Solucione ambos problemas iterando sobre el array en orden inverso con un l\u00edmite de bucle fijo. Esto garantiza que se examinen todas las entradas y que la eliminaci\u00f3n de una entrada no afecte a las iteraciones posteriores.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/rose/rose_route.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"94e0918e39039c47ddceb609500817f7266be756\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"fe62a35fb1f77f494ed534fc69a9043dc5a30ce1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"2b952dbb32fef835756f07ff0cd77efbb836dfea\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"b6b232e16e08c6dc120672b4753392df0d28c1b4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"7a1841c9609377e989ec41c16551309ce79c39e4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"446ac00b86be1670838e513b643933d78837d8db\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"2c6c82ee074bfcfd1bc978ec45bfea37703d840a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"34a500caf48c47d5171f4aa1f237da39b07c6157\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/rose/rose_route.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.296\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.240\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.187\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.144\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.97\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.37\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15.6\",\"lessThanOrEqual\":\"6.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.6.13\",\"versionEndExcluding\":\"5.4.296\",\"matchCriteriaId\":\"4FB4C5CA-BF3E-41D0-9451-C110FB7E62C6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.240\",\"matchCriteriaId\":\"0E73A49A-F9B2-470F-91B2-6FAB6239BDB6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.187\",\"matchCriteriaId\":\"4BD28D29-423C-4173-9DB8-3BA14E9F665D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.144\",\"matchCriteriaId\":\"81CF08DB-B7A2-4556-8AE3-ED9144F50E31\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.97\",\"matchCriteriaId\":\"EB1BB991-B903-4718-966C-07C803CBEABC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.37\",\"matchCriteriaId\":\"6B4159AA-C70D-4DE5-9EE2-8F2728F13C5D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.15.6\",\"matchCriteriaId\":\"6E0BB4E0-44BC-4645-83A8-6EA232CE624C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:2.6.12:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"6F62EECE-8FB1-4D57-85D8-CB9E23CF313C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4F76C298-81DC-43E4-8FC9-DC005A2116EF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"0AB349B2-3F78-4197-882B-90ADB3BF645A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"6AC88830-A9BC-4607-B572-A4B502FC9FD0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"476CB3A5-D022-4F13-AAEF-CB6A5785516A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"6D4894DB-CCFE-4602-B1BF-3960B2E19A01\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"09709862-E348-4378-8632-5A7813EDDC86\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"415BF58A-8197-43F5-B3D7-D1D63057A26E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"A0517869-312D-4429-80C2-561086E1421C\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2b952dbb32fef835756f07ff0cd77efbb836dfea\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2c6c82ee074bfcfd1bc978ec45bfea37703d840a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/34a500caf48c47d5171f4aa1f237da39b07c6157\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/446ac00b86be1670838e513b643933d78837d8db\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7a1841c9609377e989ec41c16551309ce79c39e4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/94e0918e39039c47ddceb609500817f7266be756\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b6b232e16e08c6dc120672b4753392df0d28c1b4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fe62a35fb1f77f494ed534fc69a9043dc5a30ce1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:32:39+00:00",
      "cve": "CVE-2025-38377",
      "id": "CVE-2025-38377",
      "initial_release_date": "2025-07-25T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: rose: fix dangling neighbour pointers in rose_rt_device_down()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38377.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.