CVE-2025-21792

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt

If an AX25 device is bound to a socket by setting the SO_BINDTODEVICE

socket option, a refcount leak will occur in ax25_release().

Commit 9fd75b66b8f6 ("ax25: Fix refcount leaks caused by ax25_cb_del()")

added decrement of device refcounts in ax25_release(). In order for that

to work correctly the refcounts must already be incremented when the

device is bound to the socket. An AX25 device can be bound to a socket

by either calling ax25_bind() or setting SO_BINDTODEVICE socket option.

In both cases the refcounts should be incremented, but in fact it is done

only in ax25_bind().

This bug leads to the following issue reported by Syzkaller:

================================================================

refcount_t: decrement hit 0; leaking memory.

WARNING: CPU: 1 PID: 5932 at lib/refcount.c:31 refcount_warn_saturate+0x1ed/0x210 lib/refcount.c:31

Module

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References