linux-kernel - Re: [PATCH] rose: Fix use-after-free in rose_timer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <5a88b747-bb06-4ebd-99de-80ceb574cf22@free.fr>
Date: Mon, 19 Jan 2026 21:19:21 +0100
From: F6BVP <f6bvp@...e.fr>
To: kartikey406@...il.com
Cc: davem@...emloft.net, edumazet@...gle.com, horms@...nel.org,
 kuba@...nel.org, linux-hams@...r.kernel.org, linux-kernel@...r.kernel.org,
 mingo@...nel.org, netdev@...r.kernel.org, pabeni@...hat.com,
 syzbot+62360d745376b40120b5@...kaller.appspotmail.com,
 takamitz@...zon.co.jp, tglx@...nel.org
Subject: Re: [PATCH] rose: Fix use-after-free in rose_timer_expiry

Patch applied to rose_timer.c

Result is interesting even if

rose module cannot still be removed with rmmod command.

For a very long time rmmod would freeze the console and the task could 
not be killed.

With the patch applied rmmod command is not blocked anymore.

However rose module is not removed probably because of a wrong refcount ?

lsmod | grep rose
rose                  184320  -1
ax25                  217088  1 rose

Bernard, f6bvp