AX.25, ROSE and NET/ROM fixes in the Linux LTS kernels
Status as of 2026-10-16 19:45. Page updated whenever a new release is published or a new fix is merged. Version française
This page shows which releases of the 6.12 and 6.18 long-term kernels contain the fixes by F6BVP merged in the linux-netdev/mod-orphan repository, and where the Raspberry Pi kernels stand. To find your kernel version: uname -r.
Kernel 6.12 LTS
- 10 of 47 merged fixes
- Other AX.25 fix(es) queued, not in the list:
• ax25: Remove broken autobind rpi-updateno longer follows this series- Raspberry Pi OS bookworm (apt): 6.12.109
Kernel 6.18 LTS
- 19 of 47 merged fixes
rpi-update: 6.18.56 today; 6.18.57 expected around 2026-10-22- Raspberry Pi OS trixie (apt): 6.18.50
Warning, 6.18 kernels from 6.18.37 onwards. They contain "rose: release netdev ref and destroy orphaned incoming sockets", which introduced a regression. Its fix, "rose: hold a reference on incoming sockets queued for accept()", is still under review. The patched modules are still needed on these kernels.
Merged fixes: first release that contains each one
| Fix | 6.12 | 6.18 |
|---|---|---|
| rose: fix dev_put() leak in rose_loopback_timer() | 6.12.112 | 6.18.37 |
| rose: hold loopback neighbour reference across timer callback | 6.12.112 | 6.18.37 |
| rose: fix race between loopback timer and module removal | 6.12.112 | 6.18.37 |
| rose: clear neighbour pointer after rose_neigh_put() in state machines | 6.12.112 | 6.18.37 |
| rose: guard rose_neigh_put() against NULL in timer expiry | 6.12.112 | 6.18.37 |
| rose: fix netdev double-hold in rose_rx_call_request() | 6.12.112 | 6.18.37 |
| rose: fix notifier unregistered too early in rose_exit() | 6.12.112 | 6.18.37 |
| rose: set SOCK_DESTROY in rose_kill_by_device() for prompt cleanup | missing | 6.18.37 |
| rose: disconnect orphaned STATE_2 sockets when device is gone | missing | 6.18.37 |
| rose: fix netdev double-hold in rose_make_new() | 6.12.112 | 6.18.37 |
| rose: release netdev ref and destroy orphaned incoming sockets | missing | 6.18.37 |
| rose: drop CALL_REQUEST in loopback timer when device is not running | 6.12.112 | 6.18.37 |
| rose: cancel neighbour timers in rose_neigh_put() before freeing | 6.12.112 | 6.18.37 |
| rose: clear neighbour pointer in rose_kill_by_device() | missing | 6.18.37 |
| rose: don't free fd-owned sockets when reaping in the heartbeat | missing | 6.18.37 |
| rose: keep the route needed for routing loop detection | missing | 6.18.55 |
| rose: guard rose_transmit_link() against a NULL neighbour | missing | 6.18.55 |
| rose: use timer_shutdown_sync() for t0timer teardown | missing | 6.18.55 |
| rose: don't warn on stray CALL_ACCEPTED/CLEAR_CONFIRMATION in state 3 | missing | 6.18.55 |
| ax25: bound REJ-driven fast retransmits with the existing N2 counter | missing | missing |
| rose: purge rose_neigh->queue on final teardown | missing | missing |
| rose: hold a reference on incoming sockets queued for accept() | missing | missing |
| rose: clear stale N(R)/N(S) before (re)transmitting a data frame | missing | missing |
| netrom: linearize and validate lengths in nr_rx_frame() | missing | missing |
| netrom: require full NET/ROM headers in nr_route_frame() | missing | missing |
| net: netrom: validate source address in nr_find_socket() | missing | missing |
| netrom: bound fragment reassembly in nr_queue_rx_frame() | missing | missing |
| ax25: fix OOB read after address header strip in ax25_rcv() | missing | missing |
| ax25: check frame length in ax25_decode() and ax25_rx_iframe() | missing | missing |
| net: ax25: fix integer overflow in ax25_rx_fragment() | missing | missing |
| netrom: use a single lock for the node and neighbour lists | missing | missing |
| netrom: look up and update routes in one critical section | missing | missing |
| netrom: fix reference count leak in nr_rt_device_down | missing | missing |
| netrom: clear nr_neigh->ax25 under the routing lock in nr_link_failed() | missing | missing |
| netrom: fix nr_node leak when nr_del_node() removes the last route | missing | missing |
| rose: clear through routes when a neighbour is removed from the tables | missing | missing |
| rose: restart the link of a neighbour created over a live AX.25 connection | missing | missing |
| ax25: serialise the transmission of I frames on a connection | missing | missing |
| rose: process received frames and send with the socket locked | missing | missing |
| ax25: don't create two connections for the same link in ax25_send_frame() | missing | missing |
| ax25: read the connection's ax25_dev only once when walking ax25_list | missing | missing |
| ax25: wait for ax25_send_frame() before detaching the connections of a device | missing | missing |
| ax25: don't accept frames on a device that is going down | missing | missing |
| ax25: send a private copy of each I frame | missing | missing |
| rose: clear the circuits of a neighbour that restarts the link | missing | missing |
| ax25: send unacknowledged I frames again when a link is re-established | missing | missing |
| rose: bring up the link of the preferred route passed over by a connect request | missing | missing |
A number is the first published release that contains the fix; every later release of the same series contains it too. "Queued": accepted by the stable kernel maintainers, due in the next release. Raspberry Pi kernels usually follow kernel.org by about a week.
Updating a Raspberry Pi as fixes are released
- Note your current kernel:
uname -r. - In the table above, find the first release that contains the fixes you want. Compare it,
in the cards at the top of the page, with what
rpi-updateand the Raspberry Pi OS packages offer today. - Normal way: the stable Raspberry Pi OS kernel, through the packages.
It follows kernel.org after a variable delay.
sudo apt update sudo apt full-upgrade sudo reboot
- Fast way:
rpi-update, about a week after kernel.org.sudo rpi-update sudo reboot
rpi-updateinstalls a pre-release kernel and firmware, in the 6.18 series only. Back up the SD card first, and keep it for a node you know how to reinstall. - After the reboot, check the version with
uname -r, then that the modules are loaded:lsmod | grep -E "ax25|rose|netrom". - If you run rebuilt patched modules, rebuild them after every kernel change: a module only loads on the exact kernel it was built for.
A Raspberry Pi still on Raspberry Pi OS bookworm follows the 6.12 series, through the packages only.
Keeping AX.25 on a Debian or Ubuntu PC
AX.25, NET/ROM and ROSE were removed from the Linux kernel in version 7.1. A distribution whose kernel is 7.1 or later no longer provides them. Running an older kernel remains possible.
- Ubuntu 26.04 LTS: its default kernel is 7.0 (package
linux-generic), with AX.25, NET/ROM and ROSE, maintained for the whole life of the LTS. Just do not install the HWE kernel (linux-generic-hwe-26.04), which will move to versions without AX.25. - Ubuntu 26.10 and later: 7.0 is no longer in the archive. You can install the 26.04 kernel packages by hand and select that kernel at boot (GRUB), but it is unsupported.
- Debian 13 (trixie): kernel 6.12 LTS, with AX.25. Nothing to do.
- A later Debian with a 7.1 or newer kernel: keep the 6.12 kernel already installed, or take it from the previous release's archive, also unsupported.
With a kernel older than the distribution's own:
- it no longer receives the distribution's security updates;
- with Secure Boot, a kernel not signed by the distribution will not boot unless you disable Secure Boot or enrol a key;
- third-party modules (graphics drivers, DKMS) must be rebuilt for that kernel;
- hold the kernel meta-packages (
apt-mark hold) so that an upgrade does not replace it.
Prefer a kernel that is still maintained and contains AX.25: the Ubuntu 26.04 7.0 kernel, or the 6.18 and 6.12 LTS series, which are also the ones receiving the fixes. The kernel.org 7.0.x series is no longer maintained.
Fixes under review
These are not in any official kernel yet. They are only available with the patched modules.