Subject: [BUG] rose/ax25: use-after-free in rose_transmit_restart_request()

From: [email-masked]
Date: Wed, 13 May 2026 19:27:37 +0300

Hi all,

I am reporting a use-after-free in ROSE/AX.25 networking subsystem.

Bug:
In rose_transmit_restart_request() (net/rose/rose_link.c),
ax25_send_frame() accesses a rose_neigh object after it may be freed
by rose_neigh_put() in rose_t0timer_expiry().

Root cause:
Missing reference hold across timer vs transmit race.

Fix:
rose_neigh_hold(neigh);
ax25_send_frame(...);
rose_neigh_put(neigh);

Syzbot report:
https://syzkaller.appspot.com/bug?extid=9c8999af06ca7df15fc6

Best regards,
Afi0