In the Linux kernel, the following vulnerability has been resolved:
rose: fix dangling neighbour pointers in rosertdevice_down()
There are two bugs in rosertdevice_down() that can cause use-after-free:
The loop bound t->count is modified within the loop, which can
cause the loop to terminate early and miss some entries.
When removing an entry from the neighbour array, the subsequent entries
are moved up to fill the gap, but the loop index i is still
incremented, causing the next entry to be skipped.
For example, if a node has three neighbours (A, A, B) with count=3 and A is being removed, the second A is not checked.
i=0: (A, A, B) -> (A, B) with count=2
      ^ checked
i=1: (A, B)    -> (A, B) with count=2
         ^ checked (B, not A!)
i=2: (doesn't occur because i < count is false)
This leaves the second A in the array with count=2, but the rose_neigh
structure has been freed. Code that accesses these entries assumes that
the first count entries are valid pointers, causing a use-after-free
when it accesses the dangling pointer.
Fix both issues by iterating over the array in reverse order with a fixed loop bound. This ensures that all entries are examined and that the removal of an entry doesn't affect subsequent iterations.
[
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2b952dbb32fef835756f07ff0cd77efbb836dfea",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "function": "rose_rt_device_down",
            "file": "net/rose/rose_route.c"
        },
        "id": "CVE-2025-38377-162befa6",
        "signature_type": "Function",
        "digest": {
            "length": 802.0,
            "function_hash": "201800367324122682809027084494632134297"
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@94e0918e39039c47ddceb609500817f7266be756",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "net/rose/rose_route.c"
        },
        "id": "CVE-2025-38377-171c612a",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "333128723447713189429847302164033879977",
                "74180029475810262953413917140177264811",
                "235559453075650611662561844573520645719",
                "46575350036828000983571628336506184031",
                "264080118385780893350461724304430007704",
                "298148097318864761158544150660154447768",
                "139896724237820366566571196329759664505",
                "192241456475135326004400289440932885866",
                "340243703580999593403446607763498149855",
                "166636202649589955120214818474741965805",
                "312107913382624232992058937118125278689",
                "126017641260532524009780033940581780328",
                "229584473172836835728680136525658746292",
                "142524124513442124383353630288712437526",
                "170300634614355018671277967359538732865",
                "209941540537620217013037643932806989505"
            ]
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c6c82ee074bfcfd1bc978ec45bfea37703d840a",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "net/rose/rose_route.c"
        },
        "id": "CVE-2025-38377-183a4831",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "333128723447713189429847302164033879977",
                "74180029475810262953413917140177264811",
                "235559453075650611662561844573520645719",
                "46575350036828000983571628336506184031",
                "264080118385780893350461724304430007704",
                "298148097318864761158544150660154447768",
                "139896724237820366566571196329759664505",
                "197558730407933173663572721768322954387",
                "301219897651018165796076644564010125132",
                "47219056316497480524531463853615290474",
                "157140727960817923471025328845830967764",
                "312107913382624232992058937118125278689",
                "126017641260532524009780033940581780328",
                "229584473172836835728680136525658746292",
                "142524124513442124383353630288712437526",
                "170300634614355018671277967359538732865",
                "209941540537620217013037643932806989505"
            ]
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c6c82ee074bfcfd1bc978ec45bfea37703d840a",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "function": "rose_rt_device_down",
            "file": "net/rose/rose_route.c"
        },
        "id": "CVE-2025-38377-2a875d30",
        "signature_type": "Function",
        "digest": {
            "length": 802.0,
            "function_hash": "201800367324122682809027084494632134297"
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b6b232e16e08c6dc120672b4753392df0d28c1b4",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "net/rose/rose_route.c"
        },
        "id": "CVE-2025-38377-3930cdf9",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "333128723447713189429847302164033879977",
                "74180029475810262953413917140177264811",
                "235559453075650611662561844573520645719",
                "46575350036828000983571628336506184031",
                "264080118385780893350461724304430007704",
                "298148097318864761158544150660154447768",
                "139896724237820366566571196329759664505",
                "197558730407933173663572721768322954387",
                "301219897651018165796076644564010125132",
                "47219056316497480524531463853615290474",
                "157140727960817923471025328845830967764",
                "312107913382624232992058937118125278689",
                "126017641260532524009780033940581780328",
                "229584473172836835728680136525658746292",
                "142524124513442124383353630288712437526",
                "170300634614355018671277967359538732865",
                "209941540537620217013037643932806989505"
            ]
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@34a500caf48c47d5171f4aa1f237da39b07c6157",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "function": "rose_rt_device_down",
            "file": "net/rose/rose_route.c"
        },
        "id": "CVE-2025-38377-4f698ed9",
        "signature_type": "Function",
        "digest": {
            "length": 802.0,
            "function_hash": "201800367324122682809027084494632134297"
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7a1841c9609377e989ec41c16551309ce79c39e4",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "net/rose/rose_route.c"
        },
        "id": "CVE-2025-38377-6d838ea0",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "333128723447713189429847302164033879977",
                "74180029475810262953413917140177264811",
                "235559453075650611662561844573520645719",
                "46575350036828000983571628336506184031",
                "264080118385780893350461724304430007704",
                "298148097318864761158544150660154447768",
                "139896724237820366566571196329759664505",
                "197558730407933173663572721768322954387",
                "301219897651018165796076644564010125132",
                "47219056316497480524531463853615290474",
                "157140727960817923471025328845830967764",
                "312107913382624232992058937118125278689",
                "126017641260532524009780033940581780328",
                "229584473172836835728680136525658746292",
                "142524124513442124383353630288712437526",
                "170300634614355018671277967359538732865",
                "209941540537620217013037643932806989505"
            ]
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2b952dbb32fef835756f07ff0cd77efbb836dfea",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "net/rose/rose_route.c"
        },
        "id": "CVE-2025-38377-8da2f912",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "333128723447713189429847302164033879977",
                "74180029475810262953413917140177264811",
                "235559453075650611662561844573520645719",
                "46575350036828000983571628336506184031",
                "264080118385780893350461724304430007704",
                "298148097318864761158544150660154447768",
                "139896724237820366566571196329759664505",
                "197558730407933173663572721768322954387",
                "301219897651018165796076644564010125132",
                "47219056316497480524531463853615290474",
                "157140727960817923471025328845830967764",
                "312107913382624232992058937118125278689",
                "126017641260532524009780033940581780328",
                "229584473172836835728680136525658746292",
                "142524124513442124383353630288712437526",
                "170300634614355018671277967359538732865",
                "209941540537620217013037643932806989505"
            ]
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7a1841c9609377e989ec41c16551309ce79c39e4",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "function": "rose_rt_device_down",
            "file": "net/rose/rose_route.c"
        },
        "id": "CVE-2025-38377-9298913b",
        "signature_type": "Function",
        "digest": {
            "length": 802.0,
            "function_hash": "201800367324122682809027084494632134297"
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b6b232e16e08c6dc120672b4753392df0d28c1b4",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "function": "rose_rt_device_down",
            "file": "net/rose/rose_route.c"
        },
        "id": "CVE-2025-38377-96476732",
        "signature_type": "Function",
        "digest": {
            "length": 802.0,
            "function_hash": "201800367324122682809027084494632134297"
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@34a500caf48c47d5171f4aa1f237da39b07c6157",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "net/rose/rose_route.c"
        },
        "id": "CVE-2025-38377-c31edb52",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "333128723447713189429847302164033879977",
                "74180029475810262953413917140177264811",
                "235559453075650611662561844573520645719",
                "46575350036828000983571628336506184031",
                "264080118385780893350461724304430007704",
                "298148097318864761158544150660154447768",
                "139896724237820366566571196329759664505",
                "197558730407933173663572721768322954387",
                "301219897651018165796076644564010125132",
                "47219056316497480524531463853615290474",
                "157140727960817923471025328845830967764",
                "312107913382624232992058937118125278689",
                "126017641260532524009780033940581780328",
                "229584473172836835728680136525658746292",
                "142524124513442124383353630288712437526",
                "170300634614355018671277967359538732865",
                "209941540537620217013037643932806989505"
            ]
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@94e0918e39039c47ddceb609500817f7266be756",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "function": "rose_rt_device_down",
            "file": "net/rose/rose_route.c"
        },
        "id": "CVE-2025-38377-f84ff3d7",
        "signature_type": "Function",
        "digest": {
            "length": 788.0,
            "function_hash": "175672268801932498443958062935172120009"
        }
    }
]