Security readout for executives and security teams
Plain-English summary
A race in the Linux kernel’s ROSE networking code can free a network-neighbour object while another operation or timer still uses it. This use-after-free could crash the system or potentially compromise confidentiality and integrity. The supplied CVSS score is 8.8, but practical exposure depends on whether affected ROSE functionality is present and reachable.
Executive priority
Treat as a high-priority kernel remediation for systems using or exposing ROSE networking. Patch those systems promptly, then validate lower-likelihood assets through configuration and vendor-package review. Broad emergency action across every Linux host is not supported by the supplied evidence, and no active exploitation is established.
Technical view
The unsigned-short rose_neigh use counter was non-atomic. Concurrent rose_rt_ioctl() and timer-related paths could reduce it to zero, remove the object, and subsequently access freed memory. The correction converts the field to refcount_t and routes references through atomic rose_neigh_hold() and rose_neigh_put() operations.
Likely exposure
Exposure is limited to Linux systems running affected kernel code where ROSE networking is available and the vulnerable paths are reachable. The bundle lists affected versions but does not provide sufficiently clear range semantics for precise package-level decisions. Distribution, appliance, and embedded-product mappings require confirmation through their vendors.
Exploitation context
The supplied vector indicates adjacent-network access, low complexity, no privileges, and no user interaction, with potentially high impact. However, the bundle provides no confirmed exploit, observed attack campaign, or public weaponization evidence. The CVE is not identified as being in CISA KEV.
Researcher notes
The failure is a lifetime-management race involving rose_neigh references, ioctl-driven removal, and an active timer. Review should focus on non-atomic reference transitions and whether downstream kernels contain an equivalent refcount_t backport. Exact affected and fixed package boundaries, exploitability constraints, and real-world exploitation are incomplete in the supplied evidence.
Mitigation direction
- Install a vendor-supported kernel update incorporating the applicable linked stable-kernel correction.
- Check Debian, Siemens, or other relevant vendor advisories for product-specific fixed versions.
- Prioritize systems where ROSE networking is enabled, exposed, or operationally required.
- If updates must wait, restrict adjacent-network access and disable unused ROSE functionality following vendor guidance.
Validation and detection
- Inventory kernel versions and identify systems with ROSE networking configured or available.
- Compare each installed vendor package against its applicable security advisory.
- Verify the running kernel contains the relevant stable commit or vendor backport.
- After updating, reboot as required and confirm the corrected kernel is running.
- Review kernel logs for unexplained crashes or use-after-free indicators without treating absence as proof of safety.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-39826 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H2.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/fb07156cc0742ba4e93dfcc84280c011d05b301fCVE reference, Linux
- https://git.kernel.org/stable/c/f8c29fc437d03a98fb075c31c5be761cc8326284CVE reference, Linux
- https://git.kernel.org/stable/c/0085b250fcc79f900c82a69980ec2f3e1871823bCVE reference, Linux
- https://git.kernel.org/stable/c/203e4f42596ede31498744018716a3db6dbb7f51CVE reference, Linux
- https://git.kernel.org/stable/c/d860d1faa6b2ce3becfdb8b0c2b048ad31800061CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
- https://cert-portal.siemens.com/productcert/html/ssa-032379.htmlCVE reference, siemens-SADP
- https://cert-portal.siemens.com/productcert/html/ssa-019113.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.