CVE-2025-22109 is a vulnerability identified in the Linux kernel's AX.25 protocol implementation, specifically related to the 'autobind' feature used when binding AX.25 sockets. AX.25 is a network protocol primarily used in amateur radio communications. The vulnerability arises because the autobind feature improperly manages memory and reference counts during socket connection and release operations. When an AX.25 socket is bound using autobind, it leads to memory leaks in the ax25_connect() function and reference count leaks in ax25_release(). This was detected using the kernel memory leak detector (kmemleak) and further confirmed by the Syzkaller fuzzing tool, which reported refcount decrement errors and memory leaks. The root cause is that the autobind feature does not increment reference counts correctly, unlike the standard binding methods (ax25_bind() and ax25_setsockopt() with SO_BINDTODEVICE). The Linux kernel developers have decided to remove the autobind feature entirely rather than fix it, as it is inherently broken and leads to various memory management bugs. Consequently, calling connect() without explicitly binding the socket will now return an error (-EINVAL). While this change may break some userspace applications relying on autobind, such usage is reportedly rare and not supported by common AX.25 tools like ax25-tools and ax25-apps. The vulnerability does not appear to be exploited in the wild and affects Linux kernel versions prior to the patch. No CVSS score has been assigned yet. The issue was discovered by the Linux Verification Center using Syzkaller.

The primary impact of this vulnerability is a memory leak and reference count mismanagement in the Linux kernel's AX.25 networking stack. While this does not directly lead to remote code execution or privilege escalation, the memory leaks can degrade system stability and potentially lead to denial of service (DoS) conditions on affected systems, especially those heavily utilizing AX.25 networking. For European organizations, the impact is likely limited to niche environments where AX.25 is used, such as amateur radio operators, emergency communication networks, or specialized industrial or research setups that rely on AX.25. The removal of the autobind feature may cause compatibility issues with legacy or custom software that implicitly depends on this feature, potentially disrupting operations until software is updated to explicitly bind sockets. However, since the feature was unreliable and rarely used, widespread operational impact is expected to be minimal. The vulnerability does not appear to expose confidentiality or integrity risks directly. The lack of known exploits in the wild further reduces immediate risk. Nonetheless, organizations running Linux kernels with AX.25 support should be aware of potential stability issues and ensure their software is compatible with the updated kernel behavior.

1. Upgrade Linux kernels to versions where the autobind feature has been removed and this vulnerability fixed. This is the most effective mitigation. 2. Audit and update any userspace applications or custom software that use AX.25 sockets to explicitly bind sockets before calling connect(), as autobind is no longer supported. 3. For organizations using AX.25 in production or critical environments, conduct thorough testing of communication software against updated kernels to identify and resolve any compatibility issues. 4. Monitor system logs for memory leak warnings or refcount errors related to AX.25 sockets to detect potential residual issues. 5. If AX.25 is not used, consider disabling the AX.25 kernel module to reduce attack surface and avoid unnecessary kernel code execution. 6. Engage with Linux distribution maintainers to ensure timely deployment of patches and updates related to this vulnerability. 7. For environments where kernel upgrades are delayed, consider backporting patches or applying kernel-level workarounds to prevent autobind usage.