« List of all CVEs

CVE-2025-21749

net: rose: lock the socket in rose_bind()

Published: 2/27/2025 Last updated: 5/11/2026 Reserved: 12/29/2024

In the Linux kernel, the following vulnerability has been resolved: net: rose: lock the socket in rose_bind() syzbot reported a soft lockup in rose_loopback_timer(), with a repro calling bind() from multiple threads. rose_bind() must lock the socket to avoid this issue.

CNA assigner: Linux (416baaa9-dc9f-4396-8d5f-8c081fb06d67) Requested by: n/a

Opam packages affected (29)

albatross cdrom conf-bpftool conf-libbpf conf-linux-libc-dev core core_unix hvsock mirage-block-unix mm ocaml-probes ortools_solvers orun rawlink rawlink-eio rawlink-lwt restricted shell solo5 solo5-bindings-hvt solo5-bindings-spt solo5-cross-aarch64 solo5-kernel-ukvm tracy-client tuntap uring vhd-format vhd-format-lwt xapi-stdext-unix

Products affected (4)

Product Vendor Version
Linux Linux before 1.6.8
Linux Linux A1D-500-V6.11.31-AC
Linux Linux Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17
Linux Linux 9.10.5-S1 to 9.10.5-S4, 9.10.6-S1, 9.10.6-S2

References (20)