In the Linux kernel, the following vulnerability has been resolved: net: rose: include node references in rose_neigh refcount Current implementation maintains two separate reference counting mechanisms: the 'count' field in struct rose…

Overview

In the Linux kernel, the following vulnerability has been resolved:

net: rose: include node references in rose_neigh refcount

Current implementation maintains two separate reference counting mechanisms: the 'count' field in struct rose_neigh tracks references from rose_node structures, while the 'use' field (now refcount_t) tracks references from rose_sock.

This patch merges these two reference counting systems using 'use' field for proper reference management. Specifically, this patch adds incrementing and decrementing of rose_neigh->use when rose_neigh->count is incremented or decremented.

This patch also modifies rose_rt_free(), rose_rt_device_down() and rose_clear_route() to properly release references to rose_neigh objects before freeing a rose_node through rose_remove_node().

These changes ensure rose_neigh structures are properly freed only when all references, including those from rose_node structures, are released. As a result, this resolves a slab-use-after-free issue reported by Syzbot.

Affected

• linux_kernel >= 2.6.12.1, < 6.1.150
• linux_kernel >= 6.2, < 6.6.104
• linux_kernel >= 6.7, < 6.12.45
• linux_kernel >= 6.13, < 6.16.5
• linux_kernel = 2.6.12
• linux_kernel = 6.17
• debian_linux = 11.0

Remediation

Upgrade past the affected range:

• linux_kernel 6.16.5