CVE-2025-21792

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-21792", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-29T08:45:45.767Z", "datePublished": "2025-02-27T02:18:29.653Z", "dateUpdated": "2026-08-05T11:54:29.234Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:54:29.234Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt\n\nIf an AX25 device is bound to a socket by setting the SO_BINDTODEVICE\nsocket option, a refcount leak will occur in ax25_release().\n\nCommit 9fd75b66b8f6 (\"ax25: Fix refcount leaks caused by ax25_cb_del()\")\nadded decrement of device refcounts in ax25_release(). In order for that\nto work correctly the refcounts must already be incremented when the\ndevice is bound to the socket. An AX25 device can be bound to a socket\nby either calling ax25_bind() or setting SO_BINDTODEVICE socket option.\nIn both cases the refcounts should be incremented, but in fact it is done\nonly in ax25_bind().\n\nThis bug leads to the following issue reported by Syzkaller:\n\n================================================================\nrefcount_t: decrement hit 0; leaking memory.\nWARNING: CPU: 1 PID: 5932 at lib/refcount.c:31 refcount_warn_saturate+0x1ed/0x210 lib/refcount.c:31\nModules linked in:\nCPU: 1 UID: 0 PID: 5932 Comm: syz-executor424 Not tainted 6.13.0-rc4-syzkaller-00110-g4099a71718b0 #0\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\nRIP: 0010:refcount_warn_saturate+0x1ed/0x210 lib/refcount.c:31\nCall Trace:\n <TASK>\n __refcount_dec include/linux/refcount.h:336 [inline]\n refcount_dec include/linux/refcount.h:351 [inline]\n ref_tracker_free+0x710/0x820 lib/ref_tracker.c:236\n netdev_tracker_free include/linux/netdevice.h:4156 [inline]\n netdev_put include/linux/netdevice.h:4173 [inline]\n netdev_put include/linux/netdevice.h:4169 [inline]\n ax25_release+0x33f/0xa10 net/ax25/af_ax25.c:1069\n __sock_release+0xb0/0x270 net/socket.c:640\n sock_close+0x1c/0x30 net/socket.c:1408\n ...\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n ...\n </TASK>\n================================================================\n\nFix the implementation of ax25_setsockopt() by adding increment of\nrefcounts for the new device bound, and decrement of refcounts for\nthe old unbound device."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is triggered entirely through local syscalls \u2014 `socket(AF_AX25, SOCK_DGRAM, 0)`, `setsockopt(SOL_AX25, SO_BINDTODEVICE, ...)`, and `close()`. No network packet or remote peer input is involved in reaching the faulty refcount path.\nAC:L - The underflow is fully deterministic \u2014 every socket bound via SO_BINDTODEVICE and then closed drops two references it never took, with no race to win and no memory layout the attacker cannot influence. The cycle can be repeated arbitrarily to drive `ax25_dev->refcount` to zero on demand and then groom the freed slab.\nPR:L - Creating an AF_AX25 SOCK_DGRAM socket and setting SO_BINDTODEVICE require no capabilities at all \u2014 the only `capable(CAP_NET_RAW)` check in `ax25_create()` guards SOCK_RAW. On any system with AX.25 already configured (packet-radio node, APRS igate, embedded radio gateway), an ordinary unprivileged user can trigger it.\nUI:N - The attacker performs the entire sequence in their own process; no victim action, mount, or file open is needed. Closing the socket is what fires the erroneous `netdev_put()`/`ax25_dev_put()`.\nS:U - The corrupted refcounts and freed objects (`struct ax25_dev`, `struct net_device`) live in the kernel, and exploitation yields kernel-level compromise within the same security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The premature `kfree_rcu()` of `ax25_dev` leaves `dev->ax25_ptr` dangling and read by `ax25_rcv()`, `ax25_out.c`, and `ax25_ip_xmit()`, so reallocated slab contents are read back as `values[]`, `forward`, and `sysheader`. A use-after-free of this shape gives the attacker a path to disclose arbitrary kernel memory.\nI:H - After the underflow frees `ax25_dev`, the attacker can spray the slab and control `struct net_device *forward` (used as a transmit target by `ax25_fwd_dev()`), `sysheader`, and the DAMA `timer_list`, yielding write and control-flow-hijack primitives. The parallel `net_device` refcount underflow lets `unregister_netdevice()` free a netdev still in use.\nA:H - The immediate observable is a `refcount_warn_saturate` WARN followed by dereference of freed memory in the AX.25 receive and transmit paths, i.e. kernel oops/panic. Any unprivileged user can repeat the trigger to reliably crash the machine."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ax25/af_ax25.c"], "versions": [{"version": "9fd75b66b8f68498454d685dc4ba13192ae069b0", "lessThan": "90056ece99966182dc0e367f3fd2afab46ada847", "status": "affected", "versionType": "git"}, {"version": "9fd75b66b8f68498454d685dc4ba13192ae069b0", "lessThan": "94a0de224ed52eb2ecd4f4cb1b937b674c9fb955", "status": "affected", "versionType": "git"}, {"version": "9fd75b66b8f68498454d685dc4ba13192ae069b0", "lessThan": "b58f7ca86a7b8e480c06e30c5163c5d2f4e24023", "status": "affected", "versionType": "git"}, {"version": "9fd75b66b8f68498454d685dc4ba13192ae069b0", "lessThan": "470bda72fda0fcf54300466d70ce2de62f7835d2", "status": "affected", "versionType": "git"}, {"version": "9fd75b66b8f68498454d685dc4ba13192ae069b0", "lessThan": "bca0902e61731a75fc4860c8720168d9f1bae3b6", "status": "affected", "versionType": "git"}, {"version": "c44a453ffe16eb08acdc6129ac4fa0192dbc0456", "status": "affected", "versionType": "git"}, {"version": "de55a1338e6a48ff1e41ea8db1432496fbe2a62b", "status": "affected", "versionType": "git"}, {"version": "9e1e088a57c23251f1cfe9601bbd90ade2ea73b9", "status": "affected", "versionType": "git"}, {"version": "b20a5ab0f5fb175750c6bafd4cf12daccf00c738", "status": "affected", "versionType": "git"}, {"version": "452ae92b99062d2f6a34324eaf705a3b7eac9f8b", "status": "affected", "versionType": "git"}, {"version": "534156dd4ed768e30a43de0036f45dca7c54818f", "status": "affected", "versionType": "git"}, {"version": "4.14.277", "lessThan": "4.15", "status": "affected", "versionType": "semver"}, {"version": "4.19.240", "lessThan": "4.20", "status": "affected", "versionType": "semver"}, {"version": "5.4.190", "lessThan": "5.5", "status": "affected", "versionType": "semver"}, {"version": "5.10.112", "lessThan": "5.11", "status": "affected", "versionType": "semver"}, {"version": "5.15.35", "lessThan": "5.16", "status": "affected", "versionType": "semver"}, {"version": "5.17.2", "lessThan": "5.18", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ax25/af_ax25.c"], "versions": [{"version": "5.18", "status": "affected"}, {"version": "0", "lessThan": "5.18", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.129", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.79", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.16", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.13.4", "lessThanOrEqual": "6.13.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.14", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.1.129"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.6.79"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.12.16"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.13.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.14"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14.277"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19.240"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4.190"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.35"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/90056ece99966182dc0e367f3fd2afab46ada847"}, {"url": "https://git.kernel.org/stable/c/94a0de224ed52eb2ecd4f4cb1b937b674c9fb955"}, {"url": "https://git.kernel.org/stable/c/b58f7ca86a7b8e480c06e30c5163c5d2f4e24023"}, {"url": "https://git.kernel.org/stable/c/470bda72fda0fcf54300466d70ce2de62f7835d2"}, {"url": "https://git.kernel.org/stable/c/bca0902e61731a75fc4860c8720168d9f1bae3b6"}], "title": "ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-21792", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-01T19:29:51.044536Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-noinfo Not enough information"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-01T19:36:39.465Z"}}, {"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T20:59:36.026Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T20:59:36.026Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-21792", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-01T19:29:51.044536Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-noinfo Not enough information"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-01T16:56:27.760Z"}}], "cna": {"title": "ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is triggered entirely through local syscalls \u2014 `socket(AF_AX25, SOCK_DGRAM, 0)`, `setsockopt(SOL_AX25, SO_BINDTODEVICE, ...)`, and `close()`. No network packet or remote peer input is involved in reaching the faulty refcount path.\nAC:L - The underflow is fully deterministic \u2014 every socket bound via SO_BINDTODEVICE and then closed drops two references it never took, with no race to win and no memory layout the attacker cannot influence. The cycle can be repeated arbitrarily to drive `ax25_dev->refcount` to zero on demand and then groom the freed slab.\nPR:L - Creating an AF_AX25 SOCK_DGRAM socket and setting SO_BINDTODEVICE require no capabilities at all \u2014 the only `capable(CAP_NET_RAW)` check in `ax25_create()` guards SOCK_RAW. On any system with AX.25 already configured (packet-radio node, APRS igate, embedded radio gateway), an ordinary unprivileged user can trigger it.\nUI:N - The attacker performs the entire sequence in their own process; no victim action, mount, or file open is needed. Closing the socket is what fires the erroneous `netdev_put()`/`ax25_dev_put()`.\nS:U - The corrupted refcounts and freed objects (`struct ax25_dev`, `struct net_device`) live in the kernel, and exploitation yields kernel-level compromise within the same security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The premature `kfree_rcu()` of `ax25_dev` leaves `dev->ax25_ptr` dangling and read by `ax25_rcv()`, `ax25_out.c`, and `ax25_ip_xmit()`, so reallocated slab contents are read back as `values[]`, `forward`, and `sysheader`. A use-after-free of this shape gives the attacker a path to disclose arbitrary kernel memory.\nI:H - After the underflow frees `ax25_dev`, the attacker can spray the slab and control `struct net_device *forward` (used as a transmit target by `ax25_fwd_dev()`), `sysheader`, and the DAMA `timer_list`, yielding write and control-flow-hijack primitives. The parallel `net_device` refcount underflow lets `unregister_netdevice()` free a netdev still in use.\nA:H - The immediate observable is a `refcount_warn_saturate` WARN followed by dereference of freed memory in the AX.25 receive and transmit paths, i.e. kernel oops/panic. Any unprivileged user can repeat the trigger to reliably crash the machine."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "9fd75b66b8f68498454d685dc4ba13192ae069b0", "lessThan": "90056ece99966182dc0e367f3fd2afab46ada847", "versionType": "git"}, {"status": "affected", "version": "9fd75b66b8f68498454d685dc4ba13192ae069b0", "lessThan": "94a0de224ed52eb2ecd4f4cb1b937b674c9fb955", "versionType": "git"}, {"status": "affected", "version": "9fd75b66b8f68498454d685dc4ba13192ae069b0", "lessThan": "b58f7ca86a7b8e480c06e30c5163c5d2f4e24023", "versionType": "git"}, {"status": "affected", "version": "9fd75b66b8f68498454d685dc4ba13192ae069b0", "lessThan": "470bda72fda0fcf54300466d70ce2de62f7835d2", "versionType": "git"}, {"status": "affected", "version": "9fd75b66b8f68498454d685dc4ba13192ae069b0", "lessThan": "bca0902e61731a75fc4860c8720168d9f1bae3b6", "versionType": "git"}, {"status": "affected", "version": "c44a453ffe16eb08acdc6129ac4fa0192dbc0456", "versionType": "git"}, {"status": "affected", "version": "de55a1338e6a48ff1e41ea8db1432496fbe2a62b", "versionType": "git"}, {"status": "affected", "version": "9e1e088a57c23251f1cfe9601bbd90ade2ea73b9", "versionType": "git"}, {"status": "affected", "version": "b20a5ab0f5fb175750c6bafd4cf12daccf00c738", "versionType": "git"}, {"status": "affected", "version": "452ae92b99062d2f6a34324eaf705a3b7eac9f8b", "versionType": "git"}, {"status": "affected", "version": "534156dd4ed768e30a43de0036f45dca7c54818f", "versionType": "git"}, {"status": "affected", "version": "4.14.277", "lessThan": "4.15", "versionType": "semver"}, {"status": "affected", "version": "4.19.240", "lessThan": "4.20", "versionType": "semver"}, {"status": "affected", "version": "5.4.190", "lessThan": "5.5", "versionType": "semver"}, {"status": "affected", "version": "5.10.112", "lessThan": "5.11", "versionType": "semver"}, {"status": "affected", "version": "5.15.35", "lessThan": "5.16", "versionType": "semver"}, {"status": "affected", "version": "5.17.2", "lessThan": "5.18", "versionType": "semver"}], "programFiles": ["net/ax25/af_ax25.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.18"}, {"status": "unaffected", "version": "0", "lessThan": "5.18", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.129", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.79", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.16", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.13.4", "versionType": "semver", "lessThanOrEqual": "6.13.*"}, {"status": "unaffected", "version": "6.14", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/ax25/af_ax25.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/90056ece99966182dc0e367f3fd2afab46ada847"}, {"url": "https://git.kernel.org/stable/c/94a0de224ed52eb2ecd4f4cb1b937b674c9fb955"}, {"url": "https://git.kernel.org/stable/c/b58f7ca86a7b8e480c06e30c5163c5d2f4e24023"}, {"url": "https://git.kernel.org/stable/c/470bda72fda0fcf54300466d70ce2de62f7835d2"}, {"url": "https://git.kernel.org/stable/c/bca0902e61731a75fc4860c8720168d9f1bae3b6"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt\n\nIf an AX25 device is bound to a socket by setting the SO_BINDTODEVICE\nsocket option, a refcount leak will occur in ax25_release().\n\nCommit 9fd75b66b8f6 (\"ax25: Fix refcount leaks caused by ax25_cb_del()\")\nadded decrement of device refcounts in ax25_release(). In order for that\nto work correctly the refcounts must already be incremented when the\ndevice is bound to the socket. An AX25 device can be bound to a socket\nby either calling ax25_bind() or setting SO_BINDTODEVICE socket option.\nIn both cases the refcounts should be incremented, but in fact it is done\nonly in ax25_bind().\n\nThis bug leads to the following issue reported by Syzkaller:\n\n================================================================\nrefcount_t: decrement hit 0; leaking memory.\nWARNING: CPU: 1 PID: 5932 at lib/refcount.c:31 refcount_warn_saturate+0x1ed/0x210 lib/refcount.c:31\nModules linked in:\nCPU: 1 UID: 0 PID: 5932 Comm: syz-executor424 Not tainted 6.13.0-rc4-syzkaller-00110-g4099a71718b0 #0\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\nRIP: 0010:refcount_warn_saturate+0x1ed/0x210 lib/refcount.c:31\nCall Trace:\n <TASK>\n __refcount_dec include/linux/refcount.h:336 [inline]\n refcount_dec include/linux/refcount.h:351 [inline]\n ref_tracker_free+0x710/0x820 lib/ref_tracker.c:236\n netdev_tracker_free include/linux/netdevice.h:4156 [inline]\n netdev_put include/linux/netdevice.h:4173 [inline]\n netdev_put include/linux/netdevice.h:4169 [inline]\n ax25_release+0x33f/0xa10 net/ax25/af_ax25.c:1069\n __sock_release+0xb0/0x270 net/socket.c:640\n sock_close+0x1c/0x30 net/socket.c:1408\n ...\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n ...\n </TASK>\n================================================================\n\nFix the implementation of ax25_setsockopt() by adding increment of\nrefcounts for the new device bound, and decrement of refcounts for\nthe old unbound device."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.129", "versionStartIncluding": "5.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.79", "versionStartIncluding": "5.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.16", "versionStartIncluding": "5.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.13.4", "versionStartIncluding": "5.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.14", "versionStartIncluding": "5.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "4.14.277"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "4.19.240"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "5.4.190"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "5.10.112"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "5.15.35"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "5.17.2"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:54:29.234Z"}}}, "cveMetadata": {"cveId": "CVE-2025-21792", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:54:29.234Z", "dateReserved": "2024-12-29T08:45:45.767Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-02-27T02:18:29.653Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/ax25/af_ax25.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "90056ece99966182dc0e367f3fd2afab46ada847", "status": "affected", "version": "9fd75b66b8f68498454d685dc4ba13192ae069b0", "versionType": "git"}, {"lessThan": "94a0de224ed52eb2ecd4f4cb1b937b674c9fb955", "status": "affected", "version": "9fd75b66b8f68498454d685dc4ba13192ae069b0", "versionType": "git"}, {"lessThan": "b58f7ca86a7b8e480c06e30c5163c5d2f4e24023", "status": "affected", "version": "9fd75b66b8f68498454d685dc4ba13192ae069b0", "versionType": "git"}, {"lessThan": "470bda72fda0fcf54300466d70ce2de62f7835d2", "status": "affected", "version": "9fd75b66b8f68498454d685dc4ba13192ae069b0", "versionType": "git"}, {"lessThan": "bca0902e61731a75fc4860c8720168d9f1bae3b6", "status": "affected", "version": "9fd75b66b8f68498454d685dc4ba13192ae069b0", "versionType": "git"}, {"status": "affected", "version": "c44a453ffe16eb08acdc6129ac4fa0192dbc0456", "versionType": "git"}, {"status": "affected", "version": "de55a1338e6a48ff1e41ea8db1432496fbe2a62b", "versionType": "git"}, {"status": "affected", "version": "9e1e088a57c23251f1cfe9601bbd90ade2ea73b9", "versionType": "git"}, {"status": "affected", "version": "b20a5ab0f5fb175750c6bafd4cf12daccf00c738", "versionType": "git"}, {"status": "affected", "version": "452ae92b99062d2f6a34324eaf705a3b7eac9f8b", "versionType": "git"}, {"status": "affected", "version": "534156dd4ed768e30a43de0036f45dca7c54818f", "versionType": "git"}, {"lessThan": "4.15", "status": "affected", "version": "4.14.277", "versionType": "semver"}, {"lessThan": "4.20", "status": "affected", "version": "4.19.240", "versionType": "semver"}, {"lessThan": "5.5", "status": "affected", "version": "5.4.190", "versionType": "semver"}, {"lessThan": "5.11", "status": "affected", "version": "5.10.112", "versionType": "semver"}, {"lessThan": "5.16", "status": "affected", "version": "5.15.35", "versionType": "semver"}, {"lessThan": "5.18", "status": "affected", "version": "5.17.2", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/ax25/af_ax25.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.18"}, {"lessThan": "5.18", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.129", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.79", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.16", "versionType": "semver"}, {"lessThanOrEqual": "6.13.*", "status": "unaffected", "version": "6.13.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.14", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "26F3B000-E328-48CE-9B1E-68E0DFD0A909", "versionEndExcluding": "4.15", "versionStartIncluding": "4.14.277", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "36C10971-E218-4588-B691-A4A3534A3B58", "versionEndExcluding": "4.20", "versionStartIncluding": "4.19.240", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "38031C07-F0BC-442A-A08F-FB9B732F2CA5", "versionEndExcluding": "5.5", "versionStartIncluding": "5.4.190", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E1C7F59E-6FCD-4163-9D36-1585FB5A71E7", "versionEndExcluding": "5.11", "versionStartIncluding": "5.10.112", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5DFF4167-1962-4F68-81DD-C3D56FE88E76", "versionEndExcluding": "5.16", "versionStartIncluding": "5.15.35", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "EB2089C3-1FFD-4729-9C94-A45890155918", "versionEndExcluding": "6.1.129", "versionStartIncluding": "5.17.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B16AADE5-B2FD-4C14-B4E4-85E8EDAFE775", "versionEndExcluding": "6.6.79", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "13C8DB18-FC60-425F-84E5-3EDDEC61B2FC", "versionEndExcluding": "6.12.16", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "2A2093ED-74A9-43F9-AC72-50030F374EA4", "versionEndExcluding": "6.13.4", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*", "matchCriteriaId": "186716B6-2B66-4BD0-852E-D48E71C0C85F", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*", "matchCriteriaId": "0D3E781C-403A-498F-9DA9-ECEE50F41E75", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt\n\nIf an AX25 device is bound to a socket by setting the SO_BINDTODEVICE\nsocket option, a refcount leak will occur in ax25_release().\n\nCommit 9fd75b66b8f6 (\"ax25: Fix refcount leaks caused by ax25_cb_del()\")\nadded decrement of device refcounts in ax25_release(). In order for that\nto work correctly the refcounts must already be incremented when the\ndevice is bound to the socket. An AX25 device can be bound to a socket\nby either calling ax25_bind() or setting SO_BINDTODEVICE socket option.\nIn both cases the refcounts should be incremented, but in fact it is done\nonly in ax25_bind().\n\nThis bug leads to the following issue reported by Syzkaller:\n\n================================================================\nrefcount_t: decrement hit 0; leaking memory.\nWARNING: CPU: 1 PID: 5932 at lib/refcount.c:31 refcount_warn_saturate+0x1ed/0x210 lib/refcount.c:31\nModules linked in:\nCPU: 1 UID: 0 PID: 5932 Comm: syz-executor424 Not tainted 6.13.0-rc4-syzkaller-00110-g4099a71718b0 #0\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\nRIP: 0010:refcount_warn_saturate+0x1ed/0x210 lib/refcount.c:31\nCall Trace:\n <TASK>\n __refcount_dec include/linux/refcount.h:336 [inline]\n refcount_dec include/linux/refcount.h:351 [inline]\n ref_tracker_free+0x710/0x820 lib/ref_tracker.c:236\n netdev_tracker_free include/linux/netdevice.h:4156 [inline]\n netdev_put include/linux/netdevice.h:4173 [inline]\n netdev_put include/linux/netdevice.h:4169 [inline]\n ax25_release+0x33f/0xa10 net/ax25/af_ax25.c:1069\n __sock_release+0xb0/0x270 net/socket.c:640\n sock_close+0x1c/0x30 net/socket.c:1408\n ...\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n ...\n </TASK>\n================================================================\n\nFix the implementation of ax25_setsockopt() by adding increment of\nrefcounts for the new device bound, and decrement of refcounts for\nthe old unbound device."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt Si un dispositivo AX25 est\u00e1 enlazado a un socket configurando la opci\u00f3n de socket SO_BINDTODEVICE, se producir\u00e1 una p\u00e9rdida de refcount en ax25_release(). el commit 9fd75b66b8f6 (\"ax25: Fix refcount leaks caused by ax25_cb_del()\") a\u00f1adi\u00f3 una disminuci\u00f3n de los refcounts del dispositivo en ax25_release(). Para que funcione correctamente, los refcounts ya deben estar incrementados cuando el dispositivo est\u00e1 enlazado al socket. Un dispositivo AX25 puede estar enlazado a un socket llamando a ax25_bind() o configurando la opci\u00f3n de socket SO_BINDTODEVICE. En ambos casos, los refcounts deben incrementarse, pero de hecho solo se hace en ax25_bind(). Este error conduce al siguiente problema informado por Syzkaller: ================================================================= refcount_t: el decremento lleg\u00f3 a 0; p\u00e9rdida de memoria. ADVERTENCIA: CPU: 1 PID: 5932 en lib/refcount.c:31 refcount_warn_saturate+0x1ed/0x210 lib/refcount.c:31 M\u00f3dulos vinculados: CPU: 1 UID: 0 PID: 5932 Comm: syz-executor424 No contaminado 6.13.0-rc4-syzkaller-00110-g4099a71718b0 #0 Nombre del hardware: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:refcount_warn_saturate+0x1ed/0x210 lib/refcount.c:31 Seguimiento de llamadas: __refcount_dec include/linux/refcount.h:336 [en l\u00ednea] refcount_dec include/linux/refcount.h:351 [en l\u00ednea] ref_tracker_free+0x710/0x820 lib/ref_tracker.c:236 netdev_tracker_free include/linux/netdevice.h:4156 [en l\u00ednea] netdev_put include/linux/netdevice.h:4173 [en l\u00ednea] netdev_put include/linux/netdevice.h:4169 [en l\u00ednea] ax25_release+0x33f/0xa10 net/ax25/af_ax25.c:1069 __sock_release+0xb0/0x270 net/socket.c:640 sock_close+0x1c/0x30 net/socket.c:1408 ... do_syscall_x64 arch/x86/entry/common.c:52 [en l\u00ednea] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f ... ================================================================== Corrija la implementaci\u00f3n de ax25_setsockopt() agregando un incremento de recuentos de referencias para el nuevo dispositivo vinculado y una disminuci\u00f3n de recuentos de referencias para el antiguo dispositivo no vinculado."}], "id": "CVE-2025-21792", "lastModified": "2026-07-30T06:21:31.303", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-21792", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-01T19:29:51.044536Z", "version": "2.0.3"}}]}, "published": "2025-02-27T03:15:20.080", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/470bda72fda0fcf54300466d70ce2de62f7835d2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/90056ece99966182dc0e367f3fd2afab46ada847"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/94a0de224ed52eb2ecd4f4cb1b937b674c9fb955"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/b58f7ca86a7b8e480c06e30c5163c5d2f4e24023"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/bca0902e61731a75fc4860c8720168d9f1bae3b6"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt", "id": "2348555", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2348555"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-401", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt\nIf an AX25 device is bound to a socket by setting the SO_BINDTODEVICE\nsocket option, a refcount leak will occur in ax25_release().\nCommit 9fd75b66b8f6 (\"ax25: Fix refcount leaks caused by ax25_cb_del()\")\nadded decrement of device refcounts in ax25_release(). In order for that\nto work correctly the refcounts must already be incremented when the\ndevice is bound to the socket. An AX25 device can be bound to a socket\nby either calling ax25_bind() or setting SO_BINDTODEVICE socket option.\nIn both cases the refcounts should be incremented, but in fact it is done\nonly in ax25_bind().\nThis bug leads to the following issue reported by Syzkaller:\n================================================================\nrefcount_t: decrement hit 0; leaking memory.\nWARNING: CPU: 1 PID: 5932 at lib/refcount.c:31 refcount_warn_saturate+0x1ed/0x210 lib/refcount.c:31\nModules linked in:\nCPU: 1 UID: 0 PID: 5932 Comm: syz-executor424 Not tainted 6.13.0-rc4-syzkaller-00110-g4099a71718b0 #0\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\nRIP: 0010:refcount_warn_saturate+0x1ed/0x210 lib/refcount.c:31\nCall Trace:\n<TASK>\n__refcount_dec include/linux/refcount.h:336 [inline]\nrefcount_dec include/linux/refcount.h:351 [inline]\nref_tracker_free+0x710/0x820 lib/ref_tracker.c:236\nnetdev_tracker_free include/linux/netdevice.h:4156 [inline]\nnetdev_put include/linux/netdevice.h:4173 [inline]\nnetdev_put include/linux/netdevice.h:4169 [inline]\nax25_release+0x33f/0xa10 net/ax25/af_ax25.c:1069\n__sock_release+0xb0/0x270 net/socket.c:640\nsock_close+0x1c/0x30 net/socket.c:1408\n...\ndo_syscall_x64 arch/x86/entry/common.c:52 [inline]\ndo_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83\nentry_SYSCALL_64_after_hwframe+0x77/0x7f\n...\n</TASK>\n================================================================\nFix the implementation of ax25_setsockopt() by adding increment of\nrefcounts for the new device bound, and decrement of refcounts for\nthe old unbound device."], "name": "CVE-2025-21792", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-02-27T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-21792\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-21792\nhttps://lore.kernel.org/linux-cve-announce/2025022609-CVE-2025-21792-d8e8@gregkh/T"], "threat_severity": "Moderate"}

{}