Security readout for executives and security teams
Plain-English summary
A flaw in Linux’s ROSE network code can cause the kernel to use memory after freeing it because related references were counted separately. This memory corruption could crash a system or compromise data and execution integrity. The supplied assessment rates it 8.8/high, but provides no evidence of real-world exploitation.
Executive priority
Treat this as a high-priority kernel remediation for systems with verified affected builds and ROSE exposure. Systems without that exposure or with vendor-confirmed backports may warrant lower urgency. It is not currently a KEV-driven emergency, but the 8.8 score and kernel memory corruption justify prompt, evidence-based triage.
Technical view
References to rose_neigh from rose_node and rose_sock used separate counting mechanisms, permitting premature release and a slab use-after-free. The stable fixes consolidate lifetime tracking and release neighbor references before removing nodes. The supplied CVSS vector describes adjacent-network, low-complexity, unauthenticated exploitation requiring no user interaction, with high confidentiality, integrity, and availability impact.
Likely exposure
Potential exposure exists on Linux systems running affected kernel code where the ROSE networking path is available and reachable from an adjacent network. The supplied version data contains several isolated version values but does not clearly define complete affected ranges, configuration prerequisites, or distribution backports. Vendor-specific validation is therefore necessary.
Exploitation context
The CVE is not listed as KEV, and the supplied sources provide no evidence of active exploitation or a public exploit. Syzbot identified the use-after-free during testing; that demonstrates a reachable defect, not malicious exploitation. The precise conditions required to turn the flaw into compromise are not documented.
Researcher notes
The bundle provides no CWE assignment, public proof of concept, configuration prerequisites, or clear commit-to-version mapping. Version-only scanners may misclassify distribution kernels because fixes can be backported. Validate using package provenance, vendor advisories, and the applicable stable commit rather than relying solely on the displayed kernel version.
Mitigation direction
- Apply the relevant Linux vendor or distribution update containing the applicable stable fix.
- Confirm the package changelog or advisory references this CVE or a corresponding stable commit.
- If updating is delayed, obtain vendor-approved temporary mitigation; none is named in the supplied sources.
- Prioritize affected systems where ROSE networking is enabled and adjacent-network access exists.
Validation and detection
- Record each asset’s running kernel build, distribution patch level, and vendor.
- Check vendor advisories or package changelogs for CVE-2025-39827 or matching stable commits.
- Determine whether ROSE networking is configured, loaded, and reachable from adjacent networks.
- After remediation, verify the running kernel contains the vendor-confirmed fix.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-39827 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H2.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/4cce478c3e82a5fc788d72adb2f4c4e983997639CVE reference, Linux
- https://git.kernel.org/stable/c/9c547c8eee9d1cf6e744611d688b9f725cf9a115CVE reference, Linux
- https://git.kernel.org/stable/c/d7563b456ed44151e1a82091d96f60166daea89bCVE reference, Linux
- https://git.kernel.org/stable/c/384210cceb1873a4c8218b27ba0745444436b728CVE reference, Linux
- https://git.kernel.org/stable/c/da9c9c877597170b929a6121a68dcd3dd9a80f45CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
- https://cert-portal.siemens.com/productcert/html/ssa-032379.htmlCVE reference, siemens-SADP
- https://cert-portal.siemens.com/productcert/html/ssa-019113.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.