Security readout for executives and security teams
Plain-English summary
CVE-2025-38180 is a Linux kernel use-after-free flaw in ATM LAN Emulation handling. A low-privileged local user may be able to trigger serious memory corruption without user interaction. The CVSS assessment indicates possible loss of confidentiality, integrity, and availability, but the supplied sources do not confirm real-world exploitation.
Executive priority
Treat this as a high-priority kernel update for exposed shared, multi-user, or locally accessible systems. Other systems should enter the normal accelerated kernel-patching cycle after confirming applicability. Urgency reflects potential full-system impact after local access, not evidence of widespread remote attacks.
Technical view
The /proc/net/atm/lec handler is unsafe when dev_lec[] changes. It contains dev_put() calls without corresponding dev_hold() references, creating a reference-count imbalance and possible use-after-free. The flaw requires local access with low privileges and has a CVSS 3.1 score of 7.8.
Likely exposure
Exposure is most relevant to Linux systems where the affected ATM LEC proc interface is available to local users. The supplied affected-version data is ambiguous and includes multiple kernel branches, so vulnerability managers should map exact kernel packages to the applicable stable fix or distribution advisory.
Exploitation context
The CVSS vector indicates local, low-privileged exploitation with low complexity and no user interaction. CISA KEV status is false, and the supplied sources provide no evidence of active exploitation or a public exploit. This does not establish that exploitation is impossible or absent.
Researcher notes
The central condition is unsafe lifetime management around dev_lec[] and /proc/net/atm/lec, producing an apparent use-after-free through unbalanced device references. No CWE is supplied. Stable commits exist across several kernel branches, but the bundle does not provide sufficiently clear branch ranges or demonstrate exploitability beyond the CVSS assessment.
Mitigation direction
- Inventory Linux kernel builds and map each to the applicable stable fix or distribution advisory.
- Update affected systems to a vendor-supported kernel containing the relevant upstream stable correction.
- Prioritize shared or multi-user hosts where low-privileged local users can reach the affected ATM LEC path.
- If patching is delayed, restrict untrusted local access and follow vendor-approved guidance for reducing ATM LEC exposure.
Validation and detection
- Record each system's running kernel version and distribution package release.
- Determine whether /proc/net/atm/lec is present and accessible on representative systems.
- Confirm the installed package includes the applicable Linux stable commit or distribution backport.
- After updating, verify the patched kernel is running and repeat exposure checks.
- Monitor vendor advisories because the supplied version boundaries are not sufficiently clear for package-level decisions.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38180 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/fcfccf56f4eba7d00aa2d33c7bb1b33083237742CVE reference, Linux
- https://git.kernel.org/stable/c/f2d1443b18806640abdb530e88009af7be2588e7CVE reference, Linux
- https://git.kernel.org/stable/c/ca3829c18c8d0ceb656605d3bff6bb3dfb078589CVE reference, Linux
- https://git.kernel.org/stable/c/e612c4b014f5808fbc6beae21f5ccaca5e76a2f8CVE reference, Linux
- https://git.kernel.org/stable/c/a5e3a144268899f1a8c445c8a3bfa15873ba85e8CVE reference, Linux
- https://git.kernel.org/stable/c/5fe1b23a2f87f43aeeac51e08819cbc6fd808cbcCVE reference, Linux
- https://git.kernel.org/stable/c/9b9aeb3ada44d8abea1e31e4446113f460848ae4CVE reference, Linux
- https://git.kernel.org/stable/c/d03b79f459c7935cff830d98373474f440bd03aeCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.