{"id":"CVE-2025-38460","title":"In the Linux kernel, the following vulnerability has been resolved:\n\natm: clip: Fix potential null-ptr-deref in to_atmarpd().\n\natmarpd is protected by RTNL since commit f3a0592b37b8 (\"[ATM]: clip\ncauses unregister hang\").\n\nHowever, it is…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\natm: clip: Fix potential null-ptr-deref in to_atmarpd().\n\natmarpd is protected by RTNL since commit f3a0592b37b8 (\"[ATM]: clip\ncauses unregister hang\").\n\nHowever, it is…","severity":"high","cvss":7,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-476"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 2.6.13, < 5.4.296","linux_kernel >= 5.5, < 5.10.240","linux_kernel >= 5.11, < 5.15.189","linux_kernel >= 5.16, < 6.1.146","linux_kernel >= 6.2, < 6.6.99","linux_kernel >= 6.7, < 6.12.39","linux_kernel >= 6.13, < 6.15.7","linux_kernel = 2.6.12","linux_kernel = 6.16","debian_linux = 11.0"],"patched":["linux_kernel 6.15.7"],"published":"2025-07-25","updated":"2026-10-15","sourceUpdated":"2026-10-15T22:18:41.863","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-38460","references":[{"url":"https://git.kernel.org/stable/c/06935c50cfa3ac57cce80bba67b6d38ec1406e92","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3251ce3979f41bd228f77a7615f9dd616d06a110","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/36caab990b69ef4eec1d81c52a19f080b7daa059","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/706cc36477139c1616a9b2b96610a8bb520b7119","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/70eac9ba7ce25d99c1d99bbf4ddb058940f631f9","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a4c5785feb979cd996a99cfaad8bf353b2e79301","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ee4d9e4ddf3f9c4ee2ec0a3aad6196ee36d30e57","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f58e4270c73e7f086322978d585ea67c8076ce49","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd","cve.org"],"epss":0.00197,"epssPercentile":0.09299,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-15T21:50:37.490396Z"},"ingestedAt":"2026-10-15T22:48:25.508Z","slug":"CVE-2025-38460","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\natm: clip: Fix potential null-ptr-deref in to_atmarpd().\n\natmarpd is protected by RTNL since commit f3a0592b37b8 (\"[ATM]: clip\ncauses unregister hang\").\n\nHowever, it is not enough because to_atmarpd() is called without RTNL,\nespecially clip_neigh_solicit() / neigh_ops->solicit() is unsleepable.\n\nAlso, there is no RTNL dependency around atmarpd.\n\nLet's use a private mutex and RCU to protect access to atmarpd in\nto_atmarpd().\n\n## Affected\n\n- `linux_kernel >= 2.6.13, < 5.4.296`\n- `linux_kernel >= 5.5, < 5.10.240`\n- `linux_kernel >= 5.11, < 5.15.189`\n- `linux_kernel >= 5.16, < 6.1.146`\n- `linux_kernel >= 6.2, < 6.6.99`\n- `linux_kernel >= 6.7, < 6.12.39`\n- `linux_kernel >= 6.13, < 6.15.7`\n- `linux_kernel = 2.6.12`\n- `linux_kernel = 6.16`\n- `debian_linux = 11.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 6.15.7`","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":38.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}