ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt 漏洞信息(CVE-2025-21792)

一、漏洞 CVE-2025-21792 基础信息

AIGC 神龙大模型
美国国家漏洞数据库 NVD

漏洞标题

ax25: 修复设置SO_BINDTODEVICE sockopt导致的引用计数泄漏问题

来源：AIGC 神龙大模型

漏洞描述信息

N/A

来源：AIGC 神龙大模型

CVSS信息

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

来源：AIGC 神龙大模型

漏洞类别

对未经初始化资源的使用

来源：AIGC 神龙大模型

漏洞标题

ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt

来源：美国国家漏洞数据库 NVD

漏洞描述信息

In the Linux kernel, the following vulnerability has been resolved: ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt If an AX25 device is bound to a socket by setting the SO_BINDTODEVICE socket option, a refcount leak will occur in ax25_release(). Commit 9fd75b66b8f6 ("ax25: Fix refcount leaks caused by ax25_cb_del()") added decrement of device refcounts in ax25_release(). In order for that to work correctly the refcounts must already be incremented when the device is bound to the socket. An AX25 device can be bound to a socket by either calling ax25_bind() or setting SO_BINDTODEVICE socket option. In both cases the refcounts should be incremented, but in fact it is done only in ax25_bind(). This bug leads to the following issue reported by Syzkaller: ================================================================ refcount_t: decrement hit 0; leaking memory. WARNING: CPU: 1 PID: 5932 at lib/refcount.c:31 refcount_warn_saturate+0x1ed/0x210 lib/refcount.c:31 Modules linked in: CPU: 1 UID: 0 PID: 5932 Comm: syz-executor424 Not tainted 6.13.0-rc4-syzkaller-00110-g4099a71718b0 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:refcount_warn_saturate+0x1ed/0x210 lib/refcount.c:31 Call Trace: <TASK> __refcount_dec include/linux/refcount.h:336 [inline] refcount_dec include/linux/refcount.h:351 [inline] ref_tracker_free+0x710/0x820 lib/ref_tracker.c:236 netdev_tracker_free include/linux/netdevice.h:4156 [inline] netdev_put include/linux/netdevice.h:4173 [inline] netdev_put include/linux/netdevice.h:4169 [inline] ax25_release+0x33f/0xa10 net/ax25/af_ax25.c:1069 __sock_release+0xb0/0x270 net/socket.c:640 sock_close+0x1c/0x30 net/socket.c:1408 ... do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f ... </TASK> ================================================================ Fix the implementation of ax25_setsockopt() by adding increment of refcounts for the new device bound, and decrement of refcounts for the old unbound device.

来源：美国国家漏洞数据库 NVD

CVSS信息

N/A

来源：美国国家漏洞数据库 NVD

漏洞类别

N/A

来源：美国国家漏洞数据库 NVD

二、漏洞 CVE-2025-21792 的公开POC

#	POC 描述	源链接	神龙链接

三、漏洞 CVE-2025-21792 的情报信息

标题： ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt - kernel/git/stable/linux.git - Linux kernel stable tree -- 🔗来源链接

标签：
标题： ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt - kernel/git/stable/linux.git - Linux kernel stable tree -- 🔗来源链接

标签：
标题： ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt - kernel/git/stable/linux.git - Linux kernel stable tree -- 🔗来源链接

标签：
标题： ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt - kernel/git/stable/linux.git - Linux kernel stable tree -- 🔗来源链接

标签：
标题： ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt - kernel/git/stable/linux.git - Linux kernel stable tree -- 🔗来源链接

标签：
https://nvd.nist.gov/vuln/detail/CVE-2025-21792