CVE-2025-38377: Linux Kernel Use-After-Free Vulnerability

CVE-2025-38377 Overview

CVE-2025-38377 is a use-after-free vulnerability [CWE-416] in the Linux kernel's ROSE (Radio Amateur X.25 packet radio) networking subsystem. The flaw resides in the rose_rt_device_down() function, which fails to correctly iterate over the neighbour array when a network device goes down. Two logic bugs leave dangling rose_neigh pointers in the array after the underlying structure has been freed. Subsequent access to these pointers triggers use-after-free conditions in kernel memory. The vulnerability affects Linux kernel versions from 2.6.12 through 6.16-rc4 and is tracked in Debian LTS advisories.

Critical Impact
A local attacker with low privileges can trigger dangling neighbour pointers in the ROSE subsystem, leading to kernel use-after-free with high impact on confidentiality, integrity, and availability.

Affected Products

Linux kernel (from 2.6.12 through 6.16-rc4, prior to the fix commits)
Debian Linux 11.0
Systems with the ROSE (CONFIG_ROSE) kernel module loaded

Discovery Timeline

2025-07-25 - CVE-2025-38377 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2025-38377

Vulnerability Analysis

The vulnerability exists in rose_rt_device_down(), which is invoked when a network device supporting ROSE routing is brought down. The function walks the per-node neighbour array to purge entries associated with the departing device. Two compounding logic errors cause entries to be skipped and freed pointers to remain in the array.

First, the loop bound t->count is decremented inside the loop body while iteration continues against the same variable. This shortens the traversal and leaves trailing entries unvisited. Second, when a matching entry is removed, subsequent entries are shifted down to fill the gap, but the loop index i is still incremented. The shifted-in entry at position i is therefore skipped.

For a node holding neighbours (A, A, B) with count=3, removing A produces (A, B) with count=2, but the second A was never checked. The dangling pointer references memory belonging to a freed rose_neigh structure. Later code paths assume the first count entries are valid, dereferencing freed memory.

Root Cause

The root cause is unsafe in-place array compaction combined with a mutable loop bound. Iterating forward while both removing elements and updating the terminating count violates the invariant that each index is inspected exactly once. The upstream fix iterates the neighbour array in reverse with a fixed loop bound so that removals do not perturb pending iterations.

Attack Vector

Exploitation requires local access (AV:L) and low privileges (PR:L) sufficient to configure ROSE routes and toggle a ROSE-capable interface. An attacker populates a node's neighbour array with duplicate entries referencing the same rose_neigh, then triggers a device-down event. The freed but still-referenced neighbour pointer can subsequently be accessed via other ROSE routing operations, yielding a use-after-free primitive in kernel context. See the Linux kernel commit 446ac00b86be for the reference fix.

No public proof-of-concept exploit is currently listed for this issue, and it is not on the CISA KEV catalog.

Detection Methods for CVE-2025-38377

Indicators of Compromise

Kernel oops or panic messages referencing rose_rt_device_down, rose_neigh, or ROSE routing functions in dmesg or /var/log/kern.log.
KASAN reports flagging use-after-free reads or writes within the net/rose/ subsystem.
Unexpected loading of the rose and ax25 kernel modules on systems that do not use amateur radio networking.

Detection Strategies

Audit running kernels against the fixed stable versions referenced in the Debian LTS Announcement and upstream kernel commits.
Enable KASAN in test environments to surface rose_neigh use-after-free accesses during fuzzing or regression testing.
Monitor for unprivileged users invoking AF_ROSE socket operations or ip link set <dev> down on ROSE-capable interfaces.

Monitoring Recommendations

Collect kernel logs centrally and alert on stack traces containing rose_ symbols or generic slab-use-after-free signatures.
Track kernel module load events for rose and ax25 via auditd rules on the init_module and finit_module syscalls.
Baseline which hosts legitimately require the ROSE stack; treat activations elsewhere as anomalies worth investigating.

How to Mitigate CVE-2025-38377

Immediate Actions Required

Apply the Linux kernel updates from your distribution vendor that include the upstream fixes referenced in the kernel.org stable commits.
On Debian systems, install the packages published in the Debian LTS Announcement #7 and Debian LTS Announcement #8.
Where the ROSE protocol is not required, unload the rose module and blacklist it to eliminate the attack surface entirely.

Patch Information

The upstream fix rewrites rose_rt_device_down() to walk the neighbour array in reverse order with a fixed loop bound, guaranteeing that every entry is inspected once and that removals do not skew subsequent iterations. Fix commits include 446ac00b86be, 2b952dbb32fe, 2c6c82ee074b, 34a500caf48c, 7a1841c96093, 94e0918e3903, b6b232e16e08, and fe62a35fb1f7, backported across supported stable trees. Debian users should upgrade to the kernel packages listed in the referenced LTS announcements.

Workarounds

Blacklist the rose and ax25 modules in /etc/modprobe.d/ on systems that do not use amateur radio networking.
Restrict CAP_NET_ADMIN and access to raw socket families so unprivileged users cannot manipulate ROSE routes or toggle ROSE interfaces.
Use seccomp or Linux Security Modules (LSMs) such as SELinux or AppArmor to deny AF_ROSE socket creation for untrusted workloads.

bash

# Configuration example: disable the ROSE stack when not required
echo 'install rose /bin/true'  | sudo tee /etc/modprobe.d/blacklist-rose.conf
echo 'install ax25 /bin/true'  | sudo tee -a /etc/modprobe.d/blacklist-rose.conf
sudo rmmod rose 2>/dev/null || true
sudo rmmod ax25 2>/dev/null || true