CVE detail
CVE-2025-39826
In the Linux kernel, the following vulnerability has been resolved: net: rose: convert 'use' field to refcount_t The 'use' field in struct rose_neigh is used as a reference counter but lacks atomicity. This can lead to race conditions where a rose_neigh structure is freed while still being referenced by other code paths. For example, when rose_neigh->use becomes zero during an ioctl operation via rose_rt_ioctl(), the structure may be removed while its timer is still active, potentially causing use-after-free issues. This patch changes the type of 'use' from unsigned short to refcount_t and updates all code paths to use rose_neigh_hold() and rose_neigh_put() which operate reference counts atomically.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 23.0 · diversity 13.0 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 1
- within the 30d window
- Peak daily
- 1
- highest bucket
Evidence
Source links by recency
9 source links · newest first
00 CPU 1518(F)-4 PN/DP MFP are affected: SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) vers:intdot/>=3.1.6 (CVE-2021-41617, CVE-2023-28531, CVE-2023-51384, CVE-2023-52927, CVE-2024-26783, CVE-2024-27056, CVE-2024-28956, CVE-2024-36903, CVE-2024-36927, CVE-2024-42079, CVE-2024-46786, CVE-2024-47736, CVE-2024-47809, CVE-2024-49968, CVE-2024-4
governmentwww.cisa.govJul 28, 2026, 12:00 PM- https://cert-portal.siemens.com/productcert/html/ssa-032379.htmlcert-portal.siemens.com
No excerpt available.
Vendor Advisorycert-portal.siemens.comSep 16, 2025, 1:16 PM - https://cert-portal.siemens.com/productcert/html/ssa-019113.htmlcert-portal.siemens.com
No excerpt available.
Vendor Advisorycert-portal.siemens.comSep 16, 2025, 1:16 PM No excerpt available.
Vendor Advisorylists.debian.orgSep 16, 2025, 1:16 PMNo excerpt available.
Vendor Advisorygit.kernel.orgSep 16, 2025, 1:16 PMNo excerpt available.
Vendor Advisorygit.kernel.orgSep 16, 2025, 1:16 PMNo excerpt available.
Vendor Advisorygit.kernel.orgSep 16, 2025, 1:16 PMNo excerpt available.
Vendor Advisorygit.kernel.orgSep 16, 2025, 1:16 PMNo excerpt available.
Vendor Advisorygit.kernel.orgSep 16, 2025, 1:16 PM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2025-39881CVSS 7.8 · High
In the Linux kernel, the following vulnerability has been resolved: kernfs: Fix UAF in polling when open file is released A use-after-free (UAF) vulnerability was identified in…
- CVE-2025-39877CVSS 7.8 · High
In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs: fix use-after-free in state_show() state_show() reads kdamond->damon_ctx without holding damo…
- CVE-2025-39873CVSS 7.8 · High
In the Linux kernel, the following vulnerability has been resolved: can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB can_put_echo_skb() takes ownership…
- CVE-2025-39866CVSS 7.8 · High
In the Linux kernel, the following vulnerability has been resolved: fs: writeback: fix use-after-free in __mark_inode_dirty() An use-after-free issue occurred when __mark_inode_…
- CVE-2025-39864CVSS 8.8 · High
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: fix use-after-free in cmp_bss() Following bss_free() quirk introduced in commit 776b3580178f…
- CVE-2025-39860CVSS 8.0 · High
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() syzbot reported the splat below without a repro.…