High · published January 13, 2026
In the Linux kernel, the following vulnerability has been resolved:
net: rose: fix invalid array index in rose_kill_by_device()
rose_kill_by_device() collects sockets into a local array[] and then
iterates over them to disconnect sockets bound to a device being brought
down.
The loop mistakenly indexes array[cnt] instead of array[i]. For cnt <
ARRAY_SIZE(array), this reads an uninitialized entry; for cnt ==
ARRAY_SIZE(array), it is an out-of-bounds read. Either case can lead to
an invalid socket pointer dereference and also leaks references taken
via sock_hold().
Fix the index to use i.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 4.19.304, < 4.20 | 4.20 |
| linux/linux_kernel | ≥ 5.4.266, < 5.5 | 5.5 |
| linux/linux_kernel | ≥ 5.10.206, < 5.10.248 | 5.10.248 |
| linux/linux_kernel | ≥ 5.15.146, < 5.15.198 | 5.15.198 |
| linux/linux_kernel | ≥ 6.1.70, < 6.1.160 | 6.1.160 |
| linux/linux_kernel | ≥ 6.6.9, < 6.6.120 | 6.6.120 |
| linux/linux_kernel | ≥ 6.7.1, < 6.12.64 | 6.12.64 |
| linux/linux_kernel | ≥ 6.13, < 6.18.4 | 6.18.4 |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |