CVE-2025-21718: Linux Kernel Use-After-Free Vulnerability

CVE-2025-21718 Overview

CVE-2025-21718 is a race condition vulnerability in the Linux kernel's ROSE (Rec. X.25 PLP) amateur radio networking protocol implementation. The flaw resides in net/rose/rose_timer.c where ROSE timers acquire only the socket spinlock without verifying whether the socket is currently owned by a user thread. This omission allows timer callbacks to race against user threads operating on the same socket, producing a slab use-after-free condition detected by KASAN in rose_timer_expiry. The issue is tracked under CWE-362 (concurrent execution using shared resource with improper synchronization).

Critical Impact
Local attackers with access to ROSE sockets can trigger a use-after-free in kernel memory, leading to kernel memory corruption, denial of service, or potential local privilege escalation.

Affected Products

Linux kernel — multiple stable branches prior to the fix commits
Debian GNU/Linux (addressed via Debian LTS announcements in March 2025 and May 2025)
Any distribution shipping the Linux kernel with CONFIG_ROSE enabled

Discovery Timeline

2025-02-27 - CVE-2025-21718 published to the National Vulnerability Database
2025-03 - Debian LTS publishes advisory referencing the fix
2025-05 - Debian LTS publishes follow-up advisory
2025-11-03 - Last updated in NVD database

Technical Details for CVE-2025-21718

Vulnerability Analysis

The ROSE protocol implementation uses kernel timers to manage protocol state transitions and retransmissions. The handler rose_timer_expiry in net/rose/rose_timer.c runs in softirq context and acquires the per-socket spinlock to manipulate ROSE protocol state. However, user-space syscalls operating on the same socket can hold the socket via lock_sock, which is a sleepable lock distinct from the spinlock. When a timer fires while a user thread owns the socket, both contexts can mutate shared structures concurrently.

The public KASAN report shows the resulting fault: a slab-use-after-free read of size 2 at rose_timer_expiry+0x31d/0x360 triggered from softirq following __run_timer_base. The freed memory belongs to ROSE socket state that the user thread released while the timer dereferenced it.

The fix adds a sock_owned_by_user check inside the ROSE timer handlers. When the socket is owned, the timer reschedules itself instead of operating on potentially inconsistent state.

Root Cause

The root cause is improper synchronization between softirq timer callbacks and process-context syscall paths. ROSE timers relied solely on the bottom-half spinlock and did not respect the socket ownership model used by other Linux networking stacks. This allowed a timer to operate on socket fields while a user thread held lock_sock, violating the invariant that socket state mutations be serialized.

Attack Vector

Exploitation requires local access and the ability to create ROSE sockets, which typically requires CAP_NET_RAW or a kernel configured to permit ROSE socket creation by unprivileged users. An attacker schedules ROSE socket operations from user space while ROSE timers are active, racing the timer callback against socket teardown or state mutation. Successful races corrupt freed slab memory, which can be leveraged for denial of service or, with careful heap shaping, kernel memory corruption primitives.

No public proof-of-concept exploit is listed for this CVE, and it is not present in the CISA Known Exploited Vulnerabilities catalog. The EPSS score remains very low, reflecting limited attacker interest given the niche ROSE attack surface.

Detection Methods for CVE-2025-21718

Indicators of Compromise

KASAN reports referencing rose_timer_expiry or slab-use-after-free in net/rose/
Unexpected kernel oops or panic stack traces originating from run_timer_softirq with ROSE frames
Loading of the rose kernel module on systems that do not legitimately use amateur radio networking

Detection Strategies

Inventory kernel versions across Linux fleets and flag hosts running unpatched stable branches referenced by the kernel.org fix commits
Audit running kernels for the presence of the rose module via lsmod | grep rose and alert when it loads on non-radio workloads
Enable KASAN in test and pre-production kernels to surface race-induced use-after-free conditions during fuzzing or regression testing

Monitoring Recommendations

Forward dmesg and /var/log/kern.log to centralized logging and alert on KASAN, BUG:, and general protection fault strings
Monitor for unexpected kernel module loads, particularly legacy networking modules such as rose, netrom, and ax25
Track creation of AF_ROSE sockets through audit subsystem rules on the socket syscall

How to Mitigate CVE-2025-21718

Immediate Actions Required

Apply distribution kernel updates that include the upstream fix commits, including 1992fb2, 51c128b, 58051a2, 5de7665, and f55c88e
Reboot affected hosts to load the patched kernel, as live patches may not be available for every branch
Review the Debian LTS announcement (March 2025) and Debian LTS announcement (May 2025) for package versions specific to Debian releases

Patch Information

The upstream fix adds a check to ROSE timer handlers to detect when the socket is owned by a user thread and rearms the timer instead of proceeding. The change is backported across multiple stable trees; consult the kernel.org commits listed above for branch-specific patches.

Workarounds

Blacklist the rose kernel module on systems that do not require amateur radio networking by adding blacklist rose to /etc/modprobe.d/blacklist-rose.conf
Restrict creation of AF_ROSE sockets by removing CAP_NET_RAW from untrusted users and containers
Where ROSE is unused, rebuild kernels without CONFIG_ROSE to remove the vulnerable code path entirely

bash

# Configuration example: disable the ROSE module on systems that do not need it
echo 'blacklist rose' | sudo tee /etc/modprobe.d/blacklist-rose.conf
echo 'install rose /bin/true' | sudo tee -a /etc/modprobe.d/blacklist-rose.conf
sudo rmmod rose 2>/dev/null || true
lsmod | grep -E '^rose' && echo 'rose still loaded' || echo 'rose not loaded'