CVE-2025-21792

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt<br /> <br /> If an AX25 device is bound to a socket by setting the SO_BINDTODEVICE<br /> socket option, a refcount leak will occur in ax25_release().<br /> <br /> Commit 9fd75b66b8f6 ("ax25: Fix refcount leaks caused by ax25_cb_del()")<br /> added decrement of device refcounts in ax25_release(). In order for that<br /> to work correctly the refcounts must already be incremented when the<br /> device is bound to the socket. An AX25 device can be bound to a socket<br /> by either calling ax25_bind() or setting SO_BINDTODEVICE socket option.<br /> In both cases the refcounts should be incremented, but in fact it is done<br /> only in ax25_bind().<br /> <br /> This bug leads to the following issue reported by Syzkaller:<br /> <br /> ================================================================<br /> refcount_t: decrement hit 0; leaking memory.<br /> WARNING: CPU: 1 PID: 5932 at lib/refcount.c:31 refcount_warn_saturate+0x1ed/0x210 lib/refcount.c:31<br /> Modules linked in:<br /> CPU: 1 UID: 0 PID: 5932 Comm: syz-executor424 Not tainted 6.13.0-rc4-syzkaller-00110-g4099a71718b0 #0<br /> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014<br /> RIP: 0010:refcount_warn_saturate+0x1ed/0x210 lib/refcount.c:31<br /> Call Trace:<br /> <br /> __refcount_dec include/linux/refcount.h:336 [inline]<br /> refcount_dec include/linux/refcount.h:351 [inline]<br /> ref_tracker_free+0x710/0x820 lib/ref_tracker.c:236<br /> netdev_tracker_free include/linux/netdevice.h:4156 [inline]<br /> netdev_put include/linux/netdevice.h:4173 [inline]<br /> netdev_put include/linux/netdevice.h:4169 [inline]<br /> ax25_release+0x33f/0xa10 net/ax25/af_ax25.c:1069<br /> __sock_release+0xb0/0x270 net/socket.c:640<br /> sock_close+0x1c/0x30 net/socket.c:1408<br /> ...<br /> do_syscall_x64 arch/x86/entry/common.c:52 [inline]<br /> do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83<br /> entry_SYSCALL_64_after_hwframe+0x77/0x7f<br /> ...<br /> <br /> ================================================================<br /> <br /> Fix the implementation of ax25_setsockopt() by adding increment of<br /> refcounts for the new device bound, and decrement of refcounts for<br /> the old unbound device.