CVE-2025-21792 (GCVE-0-2025-21792)
Vulnerability from cvelistv5
Published
2025-02-27 02:18
Modified
2026-08-05 11:54
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt If an AX25 device is bound to a socket by setting the SO_BINDTODEVICE socket option, a refcount leak will occur in ax25_release(). Commit 9fd75b66b8f6 ("ax25: Fix refcount leaks caused by ax25_cb_del()") added decrement of device refcounts in ax25_release(). In order for that to work correctly the refcounts must already be incremented when the device is bound to the socket. An AX25 device can be bound to a socket by either calling ax25_bind() or setting SO_BINDTODEVICE socket option. In both cases the refcounts should be incremented, but in fact it is done only in ax25_bind(). This bug leads to the following issue reported by Syzkaller: ================================================================ refcount_t: decrement hit 0; leaking memory. WARNING: CPU: 1 PID: 5932 at lib/refcount.c:31 refcount_warn_saturate+0x1ed/0x210 lib/refcount.c:31 Modules linked in: CPU: 1 UID: 0 PID: 5932 Comm: syz-executor424 Not tainted 6.13.0-rc4-syzkaller-00110-g4099a71718b0 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:refcount_warn_saturate+0x1ed/0x210 lib/refcount.c:31 Call Trace: <TASK> __refcount_dec include/linux/refcount.h:336 [inline] refcount_dec include/linux/refcount.h:351 [inline] ref_tracker_free+0x710/0x820 lib/ref_tracker.c:236 netdev_tracker_free include/linux/netdevice.h:4156 [inline] netdev_put include/linux/netdevice.h:4173 [inline] netdev_put include/linux/netdevice.h:4169 [inline] ax25_release+0x33f/0xa10 net/ax25/af_ax25.c:1069 __sock_release+0xb0/0x270 net/socket.c:640 sock_close+0x1c/0x30 net/socket.c:1408 ... do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f ... </TASK> ================================================================ Fix the implementation of ax25_setsockopt() by adding increment of refcounts for the new device bound, and decrement of refcounts for the old unbound device.
References
Impacted products
Vendor Product Version
Linux Linux Version: 9fd75b66b8f68498454d685dc4ba13192ae069b0
Version: 9fd75b66b8f68498454d685dc4ba13192ae069b0
Version: 9fd75b66b8f68498454d685dc4ba13192ae069b0
Version: 9fd75b66b8f68498454d685dc4ba13192ae069b0
Version: 9fd75b66b8f68498454d685dc4ba13192ae069b0
Version: c44a453ffe16eb08acdc6129ac4fa0192dbc0456
Version: de55a1338e6a48ff1e41ea8db1432496fbe2a62b
Version: 9e1e088a57c23251f1cfe9601bbd90ade2ea73b9
Version: b20a5ab0f5fb175750c6bafd4cf12daccf00c738
Version: 452ae92b99062d2f6a34324eaf705a3b7eac9f8b
Version: 534156dd4ed768e30a43de0036f45dca7c54818f
Version: 4.14.277   ≤
Version: 4.19.240   ≤
Version: 5.4.190   ≤
Version: 5.10.112   ≤
Version: 5.15.35   ≤
Version: 5.17.2   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-21792",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:29:51.044536Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T19:36:39.465Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:59:36.026Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ax25/af_ax25.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "90056ece99966182dc0e367f3fd2afab46ada847",
              "status": "affected",
              "version": "9fd75b66b8f68498454d685dc4ba13192ae069b0",
              "versionType": "git"
            },
            {
              "lessThan": "94a0de224ed52eb2ecd4f4cb1b937b674c9fb955",
              "status": "affected",
              "version": "9fd75b66b8f68498454d685dc4ba13192ae069b0",
              "versionType": "git"
            },
            {
              "lessThan": "b58f7ca86a7b8e480c06e30c5163c5d2f4e24023",
              "status": "affected",
              "version": "9fd75b66b8f68498454d685dc4ba13192ae069b0",
              "versionType": "git"
            },
            {
              "lessThan": "470bda72fda0fcf54300466d70ce2de62f7835d2",
              "status": "affected",
              "version": "9fd75b66b8f68498454d685dc4ba13192ae069b0",
              "versionType": "git"
            },
            {
              "lessThan": "bca0902e61731a75fc4860c8720168d9f1bae3b6",
              "status": "affected",
              "version": "9fd75b66b8f68498454d685dc4ba13192ae069b0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c44a453ffe16eb08acdc6129ac4fa0192dbc0456",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "de55a1338e6a48ff1e41ea8db1432496fbe2a62b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9e1e088a57c23251f1cfe9601bbd90ade2ea73b9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b20a5ab0f5fb175750c6bafd4cf12daccf00c738",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "452ae92b99062d2f6a34324eaf705a3b7eac9f8b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "534156dd4ed768e30a43de0036f45dca7c54818f",
              "versionType": "git"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.277",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.240",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.190",
              "versionType": "semver"
            },
            {
              "lessThan": "5.11",
              "status": "affected",
              "version": "5.10.112",
              "versionType": "semver"
            },
            {
              "lessThan": "5.16",
              "status": "affected",
              "version": "5.15.35",
              "versionType": "semver"
            },
            {
              "lessThan": "5.18",
              "status": "affected",
              "version": "5.17.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ax25/af_ax25.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.129",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.79",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.129",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.79",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.16",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.4",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.277",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.240",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.190",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.10.112",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.15.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.17.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt\n\nIf an AX25 device is bound to a socket by setting the SO_BINDTODEVICE\nsocket option, a refcount leak will occur in ax25_release().\n\nCommit 9fd75b66b8f6 (\"ax25: Fix refcount leaks caused by ax25_cb_del()\")\nadded decrement of device refcounts in ax25_release(). In order for that\nto work correctly the refcounts must already be incremented when the\ndevice is bound to the socket. An AX25 device can be bound to a socket\nby either calling ax25_bind() or setting SO_BINDTODEVICE socket option.\nIn both cases the refcounts should be incremented, but in fact it is done\nonly in ax25_bind().\n\nThis bug leads to the following issue reported by Syzkaller:\n\n================================================================\nrefcount_t: decrement hit 0; leaking memory.\nWARNING: CPU: 1 PID: 5932 at lib/refcount.c:31 refcount_warn_saturate+0x1ed/0x210 lib/refcount.c:31\nModules linked in:\nCPU: 1 UID: 0 PID: 5932 Comm: syz-executor424 Not tainted 6.13.0-rc4-syzkaller-00110-g4099a71718b0 #0\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\nRIP: 0010:refcount_warn_saturate+0x1ed/0x210 lib/refcount.c:31\nCall Trace:\n \u003cTASK\u003e\n __refcount_dec include/linux/refcount.h:336 [inline]\n refcount_dec include/linux/refcount.h:351 [inline]\n ref_tracker_free+0x710/0x820 lib/ref_tracker.c:236\n netdev_tracker_free include/linux/netdevice.h:4156 [inline]\n netdev_put include/linux/netdevice.h:4173 [inline]\n netdev_put include/linux/netdevice.h:4169 [inline]\n ax25_release+0x33f/0xa10 net/ax25/af_ax25.c:1069\n __sock_release+0xb0/0x270 net/socket.c:640\n sock_close+0x1c/0x30 net/socket.c:1408\n ...\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n ...\n \u003c/TASK\u003e\n================================================================\n\nFix the implementation of ax25_setsockopt() by adding increment of\nrefcounts for the new device bound, and decrement of refcounts for\nthe old unbound device."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is triggered entirely through local syscalls \u2014 `socket(AF_AX25, SOCK_DGRAM, 0)`, `setsockopt(SOL_AX25, SO_BINDTODEVICE, ...)`, and `close()`. No network packet or remote peer input is involved in reaching the faulty refcount path.\nAC:L - The underflow is fully deterministic \u2014 every socket bound via SO_BINDTODEVICE and then closed drops two references it never took, with no race to win and no memory layout the attacker cannot influence. The cycle can be repeated arbitrarily to drive `ax25_dev-\u003erefcount` to zero on demand and then groom the freed slab.\nPR:L - Creating an AF_AX25 SOCK_DGRAM socket and setting SO_BINDTODEVICE require no capabilities at all \u2014 the only `capable(CAP_NET_RAW)` check in `ax25_create()` guards SOCK_RAW. On any system with AX.25 already configured (packet-radio node, APRS igate, embedded radio gateway), an ordinary unprivileged user can trigger it.\nUI:N - The attacker performs the entire sequence in their own process; no victim action, mount, or file open is needed. Closing the socket is what fires the erroneous `netdev_put()`/`ax25_dev_put()`.\nS:U - The corrupted refcounts and freed objects (`struct ax25_dev`, `struct net_device`) live in the kernel, and exploitation yields kernel-level compromise within the same security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The premature `kfree_rcu()` of `ax25_dev` leaves `dev-\u003eax25_ptr` dangling and read by `ax25_rcv()`, `ax25_out.c`, and `ax25_ip_xmit()`, so reallocated slab contents are read back as `values[]`, `forward`, and `sysheader`. A use-after-free of this shape gives the attacker a path to disclose arbitrary kernel memory.\nI:H - After the underflow frees `ax25_dev`, the attacker can spray the slab and control `struct net_device *forward` (used as a transmit target by `ax25_fwd_dev()`), `sysheader`, and the DAMA `timer_list`, yielding write and control-flow-hijack primitives. The parallel `net_device` refcount underflow lets `unregister_netdevice()` free a netdev still in use.\nA:H - The immediate observable is a `refcount_warn_saturate` WARN followed by dereference of freed memory in the AX.25 receive and transmit paths, i.e. kernel oops/panic. Any unprivileged user can repeat the trigger to reliably crash the machine."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:54:29.234Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/90056ece99966182dc0e367f3fd2afab46ada847"
        },
        {
          "url": "https://git.kernel.org/stable/c/94a0de224ed52eb2ecd4f4cb1b937b674c9fb955"
        },
        {
          "url": "https://git.kernel.org/stable/c/b58f7ca86a7b8e480c06e30c5163c5d2f4e24023"
        },
        {
          "url": "https://git.kernel.org/stable/c/470bda72fda0fcf54300466d70ce2de62f7835d2"
        },
        {
          "url": "https://git.kernel.org/stable/c/bca0902e61731a75fc4860c8720168d9f1bae3b6"
        }
      ],
      "title": "ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21792",
    "datePublished": "2025-02-27T02:18:29.653Z",
    "dateReserved": "2024-12-29T08:45:45.767Z",
    "dateUpdated": "2026-08-05T11:54:29.234Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T20:59:36.026Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-21792\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T19:29:51.044536Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"description\": \"CWE-noinfo Not enough information\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T16:56:27.760Z\"}}], \"cna\": {\"title\": \"ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The bug is triggered entirely through local syscalls \\u2014 `socket(AF_AX25, SOCK_DGRAM, 0)`, `setsockopt(SOL_AX25, SO_BINDTODEVICE, ...)`, and `close()`. No network packet or remote peer input is involved in reaching the faulty refcount path.\\nAC:L - The underflow is fully deterministic \\u2014 every socket bound via SO_BINDTODEVICE and then closed drops two references it never took, with no race to win and no memory layout the attacker cannot influence. The cycle can be repeated arbitrarily to drive `ax25_dev-\u003erefcount` to zero on demand and then groom the freed slab.\\nPR:L - Creating an AF_AX25 SOCK_DGRAM socket and setting SO_BINDTODEVICE require no capabilities at all \\u2014 the only `capable(CAP_NET_RAW)` check in `ax25_create()` guards SOCK_RAW. On any system with AX.25 already configured (packet-radio node, APRS igate, embedded radio gateway), an ordinary unprivileged user can trigger it.\\nUI:N - The attacker performs the entire sequence in their own process; no victim action, mount, or file open is needed. Closing the socket is what fires the erroneous `netdev_put()`/`ax25_dev_put()`.\\nS:U - The corrupted refcounts and freed objects (`struct ax25_dev`, `struct net_device`) live in the kernel, and exploitation yields kernel-level compromise within the same security authority. No VM, IOMMU, or sandbox boundary is crossed.\\nC:H - The premature `kfree_rcu()` of `ax25_dev` leaves `dev-\u003eax25_ptr` dangling and read by `ax25_rcv()`, `ax25_out.c`, and `ax25_ip_xmit()`, so reallocated slab contents are read back as `values[]`, `forward`, and `sysheader`. A use-after-free of this shape gives the attacker a path to disclose arbitrary kernel memory.\\nI:H - After the underflow frees `ax25_dev`, the attacker can spray the slab and control `struct net_device *forward` (used as a transmit target by `ax25_fwd_dev()`), `sysheader`, and the DAMA `timer_list`, yielding write and control-flow-hijack primitives. The parallel `net_device` refcount underflow lets `unregister_netdevice()` free a netdev still in use.\\nA:H - The immediate observable is a `refcount_warn_saturate` WARN followed by dereference of freed memory in the AX.25 receive and transmit paths, i.e. kernel oops/panic. Any unprivileged user can repeat the trigger to reliably crash the machine.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"9fd75b66b8f68498454d685dc4ba13192ae069b0\", \"lessThan\": \"90056ece99966182dc0e367f3fd2afab46ada847\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9fd75b66b8f68498454d685dc4ba13192ae069b0\", \"lessThan\": \"94a0de224ed52eb2ecd4f4cb1b937b674c9fb955\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9fd75b66b8f68498454d685dc4ba13192ae069b0\", \"lessThan\": \"b58f7ca86a7b8e480c06e30c5163c5d2f4e24023\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9fd75b66b8f68498454d685dc4ba13192ae069b0\", \"lessThan\": \"470bda72fda0fcf54300466d70ce2de62f7835d2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9fd75b66b8f68498454d685dc4ba13192ae069b0\", \"lessThan\": \"bca0902e61731a75fc4860c8720168d9f1bae3b6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c44a453ffe16eb08acdc6129ac4fa0192dbc0456\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"de55a1338e6a48ff1e41ea8db1432496fbe2a62b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9e1e088a57c23251f1cfe9601bbd90ade2ea73b9\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b20a5ab0f5fb175750c6bafd4cf12daccf00c738\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"452ae92b99062d2f6a34324eaf705a3b7eac9f8b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"534156dd4ed768e30a43de0036f45dca7c54818f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4.14.277\", \"lessThan\": \"4.15\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"4.19.240\", \"lessThan\": \"4.20\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.4.190\", \"lessThan\": \"5.5\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.10.112\", \"lessThan\": \"5.11\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.15.35\", \"lessThan\": \"5.16\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.17.2\", \"lessThan\": \"5.18\", \"versionType\": \"semver\"}], \"programFiles\": [\"net/ax25/af_ax25.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.18\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.18\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.129\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.79\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.16\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.13.4\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.13.*\"}, {\"status\": \"unaffected\", \"version\": \"6.14\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/ax25/af_ax25.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/90056ece99966182dc0e367f3fd2afab46ada847\"}, {\"url\": \"https://git.kernel.org/stable/c/94a0de224ed52eb2ecd4f4cb1b937b674c9fb955\"}, {\"url\": \"https://git.kernel.org/stable/c/b58f7ca86a7b8e480c06e30c5163c5d2f4e24023\"}, {\"url\": \"https://git.kernel.org/stable/c/470bda72fda0fcf54300466d70ce2de62f7835d2\"}, {\"url\": \"https://git.kernel.org/stable/c/bca0902e61731a75fc4860c8720168d9f1bae3b6\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt\\n\\nIf an AX25 device is bound to a socket by setting the SO_BINDTODEVICE\\nsocket option, a refcount leak will occur in ax25_release().\\n\\nCommit 9fd75b66b8f6 (\\\"ax25: Fix refcount leaks caused by ax25_cb_del()\\\")\\nadded decrement of device refcounts in ax25_release(). In order for that\\nto work correctly the refcounts must already be incremented when the\\ndevice is bound to the socket. An AX25 device can be bound to a socket\\nby either calling ax25_bind() or setting SO_BINDTODEVICE socket option.\\nIn both cases the refcounts should be incremented, but in fact it is done\\nonly in ax25_bind().\\n\\nThis bug leads to the following issue reported by Syzkaller:\\n\\n================================================================\\nrefcount_t: decrement hit 0; leaking memory.\\nWARNING: CPU: 1 PID: 5932 at lib/refcount.c:31 refcount_warn_saturate+0x1ed/0x210 lib/refcount.c:31\\nModules linked in:\\nCPU: 1 UID: 0 PID: 5932 Comm: syz-executor424 Not tainted 6.13.0-rc4-syzkaller-00110-g4099a71718b0 #0\\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\\nRIP: 0010:refcount_warn_saturate+0x1ed/0x210 lib/refcount.c:31\\nCall Trace:\\n \u003cTASK\u003e\\n __refcount_dec include/linux/refcount.h:336 [inline]\\n refcount_dec include/linux/refcount.h:351 [inline]\\n ref_tracker_free+0x710/0x820 lib/ref_tracker.c:236\\n netdev_tracker_free include/linux/netdevice.h:4156 [inline]\\n netdev_put include/linux/netdevice.h:4173 [inline]\\n netdev_put include/linux/netdevice.h:4169 [inline]\\n ax25_release+0x33f/0xa10 net/ax25/af_ax25.c:1069\\n __sock_release+0xb0/0x270 net/socket.c:640\\n sock_close+0x1c/0x30 net/socket.c:1408\\n ...\\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\\n do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83\\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\\n ...\\n \u003c/TASK\u003e\\n================================================================\\n\\nFix the implementation of ax25_setsockopt() by adding increment of\\nrefcounts for the new device bound, and decrement of refcounts for\\nthe old unbound device.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.129\", \"versionStartIncluding\": \"5.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.79\", \"versionStartIncluding\": \"5.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.16\", \"versionStartIncluding\": \"5.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.13.4\", \"versionStartIncluding\": \"5.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.14\", \"versionStartIncluding\": \"5.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"4.14.277\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"4.19.240\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.4.190\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.10.112\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.15.35\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.17.2\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:54:29.234Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-21792\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:54:29.234Z\", \"dateReserved\": \"2024-12-29T08:45:45.767Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-02-27T02:18:29.653Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.