CVE-2025-39827

In the Linux kernel, the following vulnerability has been resolved:

net: rose: include node references in rose_neigh refcount

Current implementation maintains two separate reference counting

mechanisms: the 'count' field in struct rose_neigh tracks references from

rose_node structures, while the 'use' field (now refcount_t) tracks

references from rose_sock.

This patch merges these two reference counting systems using 'use' field

for proper reference management. Specifically, this patch adds incrementing

and decrementing of rose_neigh->use when rose_neigh->count is incremented

or decremented.

This patch also modifies rose_rt_free(), rose_rt_device_down() and

rose_clear_route() to properly release references to rose_neigh objects

before freeing a rose_node through rose_remove_node().

These changes ensure rose_neigh structures are properly freed only when

all references, including those from rose_node structures, are released.

As a result, this resolves a slab-use-after-free issue reported by Syzbot.