Linux Kernel Use-After-Free Vulnerability in ROSE Protocol Neighbor Management

A use-after-free vulnerability has been identified in the Linux kernel's handling of neighbor pointers within the ROSE protocol. This issue arises in the function 'rose_rt_device_down()', where two bugs can lead to improper memory management. First, the loop that processes neighbor entries can terminate prematurely, causing some entries to be overlooked. Second, when an entry is removed, the remaining entries shift up to fill the gap, but the loop index continues to advance, resulting in skipped entries. This mismanagement can leave dangling pointers that, when accessed, cause a use-after-free condition.

Impact

Exploitation of this vulnerability leads to a use-after-free condition, where freed memory is accessed, potentially causing memory corruption or allowing for arbitrary code execution.