Answer in brief
CVE-2025-39827 records a Medium severity (CVSS 5.5) vulnerability in net: rose: include node references in rose_neigh refcount. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Siemens/SIMATIC CN 4100 (generic), Siemens/SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
Answer in brief
CVE-2025-39827 records a Medium severity (CVSS 5.5) vulnerability in net: rose: include node references in rose_neigh refcount. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Siemens/SIMATIC CN 4100 (generic), Siemens/SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Siemens/SIMATIC CN 4100 (generic), Siemens/SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <4cce478c3e82a5fc788d72adb2f4c4e983997639 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <9c547c8eee9d1cf6e744611d688b9f725cf9a115 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <d7563b456ed44151e1a82091d96f60166daea89b || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <384210cceb1873a4c8218b27ba0745444436b728 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <da9c9c877597170b929a6121a68dcd3dd9a80f45 | 4cce478c3e82a5fc788d72adb2f4c4e983997639, 9c547c8eee9d1cf6e744611d688b9f725cf9a115, d7563b456ed44151e1a82091d96f60166daea89b, 384210cceb1873a4c8218b27ba0745444436b728, da9c9c877597170b929a6121a68dcd3dd9a80f45 |
| Linux/Linuxgeneric | 2.6.12 | Not reported |
| Siemens/SIMATIC CN 4100generic | >=0 <V5.0 | V5.0 |
| Siemens/SIMATIC S7-1500 CPU 1518-4 PN/DP MFPgeneric | >=V3.1.6 <* | * |
| Siemens/SIMATIC S7-1500 CPU 1518F-4 PN/DP MFPgeneric | >=V3.1.6 <* | * |
| Siemens/SIPLUS S7-1500 CPU 1518-4 PN/DP MFPgeneric | >=V3.1.6 <* | * |
Published upstream
Sep 16, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 14, 2026
In the Linux kernel, the following vulnerability has been resolved: net: rose: include node references in rose_neigh refcount Current implementation maintains two separate reference counting mechanisms: the 'count' field in struct rose_neigh tracks references from rose_node structures, while the 'use' field (now refcount_t) tracks references from rose_sock. This patch merges these two reference counting systems using 'use' field for proper reference management. Specifically, this patch adds incrementing and decrementing of rose_neigh->use when rose_neigh->count is incremented or decremented. This patch also modifies rose_rt_free(), rose_rt_device_down() and rose_clear_route() to properly release references to rose_neigh objects before freeing a rose_node through rose_remove_node(). These changes ensure rose_neigh structures are properly freed only when all references, including those from rose_node structures, are released. As a result, this resolves a slab-use-after-free issue reported by Syzbot.
Quoted source text, attributed separately from HOL analysis.
CVSS is 5.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Siemens/SIMATIC CN 4100 (generic), Siemens/SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <4cce478c3e82a5fc788d72adb2f4c4e983997639 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <9c547c8eee9d1cf6e744611d688b9f725cf9a115 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <d7563b456ed44151e1a82091d96f60166daea89b || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <384210cceb1873a4c8218b27ba0745444436b728 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <da9c9c877597170b929a6121a68dcd3dd9a80f45 | 4cce478c3e82a5fc788d72adb2f4c4e983997639, 9c547c8eee9d1cf6e744611d688b9f725cf9a115, d7563b456ed44151e1a82091d96f60166daea89b, 384210cceb1873a4c8218b27ba0745444436b728, da9c9c877597170b929a6121a68dcd3dd9a80f45 |
| Linux/Linuxgeneric | 2.6.12 | Not reported |
| Siemens/SIMATIC CN 4100generic | >=0 <V5.0 | V5.0 |
| Siemens/SIMATIC S7-1500 CPU 1518-4 PN/DP MFPgeneric | >=V3.1.6 <* | * |
| Siemens/SIMATIC S7-1500 CPU 1518F-4 PN/DP MFPgeneric | >=V3.1.6 <* | * |
| Siemens/SIPLUS S7-1500 CPU 1518-4 PN/DP MFPgeneric | >=V3.1.6 <* | * |
Published upstream
Sep 16, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 14, 2026
In the Linux kernel, the following vulnerability has been resolved: net: rose: include node references in rose_neigh refcount Current implementation maintains two separate reference counting mechanisms: the 'count' field in struct rose_neigh tracks references from rose_node structures, while the 'use' field (now refcount_t) tracks references from rose_sock. This patch merges these two reference counting systems using 'use' field for proper reference management. Specifically, this patch adds incrementing and decrementing of rose_neigh->use when rose_neigh->count is incremented or decremented. This patch also modifies rose_rt_free(), rose_rt_device_down() and rose_clear_route() to properly release references to rose_neigh objects before freeing a rose_node through rose_remove_node(). These changes ensure rose_neigh structures are properly freed only when all references, including those from rose_node structures, are released. As a result, this resolves a slab-use-after-free issue reported by Syzbot.
Quoted source text, attributed separately from HOL analysis.