LiveActive security incident?Get immediate response
CVE Record

CVE-2025-38460: atm: clip: Fix potential null-ptr-deref in to_atmarpd().

In the Linux kernel, the following vulnerability has been resolved: atm: clip: Fix potential null-ptr-deref in to_atmarpd(). atmarpd is protected by RTNL since commit f3a0592b37b8 ("[ATM]: clip causes unregister hang"). However, it is not enough because to_atmarpd() is called without RTNL, especially clip_neigh_solicit() / neigh_ops->solicit() is unsleepable. Also, there is no RTNL dependency around atmarpd. Let's use a private mutex and RCU to protect access to atmarpd in to_atmarpd().

HighCVSS 7Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2025-38460 is a Linux kernel flaw in the ATM CLIP networking code. A local, low-privileged attacker may be able to trigger unsafe access to missing kernel data, potentially affecting confidentiality, integrity, and availability. Exploitation requires high complexity, and exposure is likely concentrated on systems using or supporting this legacy networking component.

Executive priority

Treat this as an expedited kernel-maintenance issue on systems with ATM CLIP support and untrusted local access. It is not currently supported as an emergency internet-wide threat: attack access is local, complexity is high, and no active exploitation is documented. Establish component exposure first, then patch affected systems through normal controlled kernel rollout procedures.

Technical view

The ATM CLIP code can call to_atmarpd() without the RTNL lock, including from the unsleepable neighbour-solicitation path. This creates unsafe concurrent access to atmarpd and a potential null-pointer dereference. Stable fixes introduce a private mutex and RCU protection. The supplied CVSS 3.1 score is 7.0: local, high-complexity, low-privilege exploitation with high potential impact.

Likely exposure

Potentially affected Linux kernels containing the vulnerable ATM CLIP implementation are in scope. Practical exposure depends on whether ATM CLIP functionality is built, available, or used. The supplied version data is not sufficiently clear for reliable range matching, so validate the running kernel against distribution advisories and the referenced stable fixes.

Exploitation context

The supplied evidence does not establish active exploitation, and the CVE is not listed as KEV. The CVSS vector describes a local attack requiring low privileges, high complexity, and no user interaction. Public sources supplied here establish the defect and fixes, but not a proven exploitation method or observed attacks.

Researcher notes

The core issue is synchronization and object-lifetime protection around atmarpd. RTNL protection is insufficient because to_atmarpd() can execute without RTNL, notably through clip_neigh_solicit()/neigh_ops->solicit(). The resolution uses a dedicated mutex plus RCU. The bundle provides multiple stable-tree commits, indicating branch-specific backports; exact vulnerable ranges should not be inferred solely from the supplied version list.

Mitigation direction

  • Install a vendor-supported kernel containing the applicable stable fix.
  • Check Linux distribution advisories for corrected package versions.
  • Prioritize systems exposing ATM CLIP functionality to untrusted local users.
  • Use vendor guidance for any temporary mitigation when immediate patching is impossible.

Validation and detection

  • Inventory running kernel versions across Linux hosts.
  • Determine whether ATM CLIP support is built, available, or operationally used.
  • Compare kernel source or package changelogs with the referenced stable fix commits.
  • Confirm patched systems booted into the corrected kernel after installation.
  • Monitor vendor advisories for revised affected-version information.
Prepared
Confidence
high
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-38460 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
11Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7CVSS 3.1HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H15.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7High
CVSS 3.1 vector shape for CVE-2025-38460Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2unaffected
LinuxLinux2.6.12, 0, 5.4.296, 5.10.240, 5.15.189, 6.1.146, 6.6.99, 6.12.39, 6.15.7, 6.16affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.