Not yet scoredPublished Feb 26, 2025

CVE-2025-21711net/rose: prevent integer overflows in rose_setsockopt()

Updated under an hour ago (Oct 27, 2026, 9:23 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: net/rose: prevent integer overflows in rose_setsockopt() In case of possible unpredictably large arguments passed to rose_setsockopt() and multiplied by extra values on top of that, integer overflows may occur. Do the safest minimum and fix these issues by checking the contents of 'opt' and returning -EINVAL if they are too large. Also, switch to unsigned int and remove useless check for negative 'opt' in ROSE_IDLE case.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Not yet received
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 14, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 4bdd449977e2364a53d0b2a5427e71beb1cd702d; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before b8583b54455cbec2fc038fa32b6700890b369815; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 9bdee49ad6bbd26ab5e13cc6731e54fb1b6c1dca; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 352daa50946c3bbb662432e8daf54d6760796589; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before d08f4074f9c69f7e95502587eb1b258a965ba7f0; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before e5338930a29d0ab2a5af402f5f664aeba0d1a676; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before d640627663bfe7d8963c7615316d7d4ef60f3b0b	CNA record
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	all versions	CISA ADP

References

References

https://git.kernel.org/stable/c/4bdd449977e2364a53d0b2a5427e71beb1cd702d
https://git.kernel.org/stable/c/b8583b54455cbec2fc038fa32b6700890b369815
https://git.kernel.org/stable/c/9bdee49ad6bbd26ab5e13cc6731e54fb1b6c1dca
https://git.kernel.org/stable/c/352daa50946c3bbb662432e8daf54d6760796589
https://git.kernel.org/stable/c/d08f4074f9c69f7e95502587eb1b258a965ba7f0
https://git.kernel.org/stable/c/e5338930a29d0ab2a5af402f5f664aeba0d1a676
https://git.kernel.org/stable/c/d640627663bfe7d8963c7615316d7d4ef60f3b0b

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.