---
id: CVE-2025-38460
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  atm: clip: Fix potential null-ptr-deref in to_atmarpd().

  atmarpd is protected by RTNL since commit f3a0592b37b8 ("[ATM]: clip
  causes unregister hang").

  However, it is…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  atm: clip: Fix potential null-ptr-deref in to_atmarpd().

  atmarpd is protected by RTNL since commit f3a0592b37b8 ("[ATM]: clip
  causes unregister hang").

  However, it is…
severity: high
cvss: 7
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-476
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 2.6.13, < 5.4.296'
  - 'linux_kernel >= 5.5, < 5.10.240'
  - 'linux_kernel >= 5.11, < 5.15.189'
  - 'linux_kernel >= 5.16, < 6.1.146'
  - 'linux_kernel >= 6.2, < 6.6.99'
  - 'linux_kernel >= 6.7, < 6.12.39'
  - 'linux_kernel >= 6.13, < 6.15.7'
  - linux_kernel = 2.6.12
  - linux_kernel = 6.16
  - debian_linux = 11.0
patched:
  - linux_kernel 6.15.7
published: '2025-07-25'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T22:18:41.863'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-38460'
references:
  - url: 'https://git.kernel.org/stable/c/06935c50cfa3ac57cce80bba67b6d38ec1406e92'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/3251ce3979f41bd228f77a7615f9dd616d06a110'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/36caab990b69ef4eec1d81c52a19f080b7daa059'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/706cc36477139c1616a9b2b96610a8bb520b7119'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/70eac9ba7ce25d99c1d99bbf4ddb058940f631f9'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a4c5785feb979cd996a99cfaad8bf353b2e79301'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ee4d9e4ddf3f9c4ee2ec0a3aad6196ee36d30e57'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f58e4270c73e7f086322978d585ea67c8076ce49'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - cve.org
epss: 0.00197
epssPercentile: 0.09299
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T21:50:37.490396Z'
ingestedAt: '2026-10-15T22:48:25.508Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

atm: clip: Fix potential null-ptr-deref in to_atmarpd().

atmarpd is protected by RTNL since commit f3a0592b37b8 ("[ATM]: clip
causes unregister hang").

However, it is not enough because to_atmarpd() is called without RTNL,
especially clip_neigh_solicit() / neigh_ops->solicit() is unsleepable.

Also, there is no RTNL dependency around atmarpd.

Let's use a private mutex and RCU to protect access to atmarpd in
to_atmarpd().

## Affected

- `linux_kernel >= 2.6.13, < 5.4.296`
- `linux_kernel >= 5.5, < 5.10.240`
- `linux_kernel >= 5.11, < 5.15.189`
- `linux_kernel >= 5.16, < 6.1.146`
- `linux_kernel >= 6.2, < 6.6.99`
- `linux_kernel >= 6.7, < 6.12.39`
- `linux_kernel >= 6.13, < 6.15.7`
- `linux_kernel = 2.6.12`
- `linux_kernel = 6.16`
- `debian_linux = 11.0`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.15.7`