Security readout for executives and security teams
Plain-English summary
A Linux AppleTalk routing flaw can leak a network-device reference when an existing route is updated. Repeated triggering may prevent resources from being released. The supplied rating is high, but the evidence does not establish remote reachability, observed exploitation, or the practical path from this leak to confidentiality and integrity impact.
Executive priority
Prioritize patch assessment for multi-user or otherwise untrusted Linux hosts using AppleTalk. Treat it as a scheduled high-severity kernel update, escalating where local users can reach route management. Internet-facing status alone does not increase urgency because the supplied evidence indicates local access and provides no active-exploitation signal.
Technical view
In atrtr_create(), replacing an existing route’s device failed to release the old device reference before retaining the new one. Stable-kernel fixes add dev_put() before reassignment. The supplied CVSS 3.1 score is 7.8 with local access, low complexity, low privileges, no user interaction, and high confidentiality, integrity, and availability impacts.
Likely exposure
Exposure concerns Linux systems running a listed affected kernel where the AppleTalk networking component is present and existing routes can be updated. The supplied data lists releases from 2.6.12 through 6.16, but does not clearly define every vulnerable range. Systems without reachable AppleTalk route-management functionality likely have reduced exposure.
Exploitation context
The supplied CVSS vector describes local, low-privileged access; it does not support remote exploitation. CISA KEV status is false, and no supplied source reports active exploitation or a public exploit. Required permissions and the reliability or security consequences of repeatedly triggering the reference leak are not fully documented in the bundle.
Researcher notes
The root cause and correction are specific: an old device reference is not released during route replacement, and dev_put() restores reference balance. The bundle provides multiple stable-branch commits but no reproduction details, affected-range mapping, CWE, crash evidence, or explanation supporting the CVSS high confidentiality and integrity impacts. Those gaps warrant vendor-specific verification.
Mitigation direction
- Install a vendor-supported kernel containing the cited stable fix.
- Follow distribution advisories for exact package versions and reboot requirements.
- Where operationally acceptable, disable or avoid loading unused AppleTalk functionality.
- Restrict local access and route-management privileges pending remediation.
Validation and detection
- Inventory kernel versions and compare them with current vendor advisories.
- Determine whether AppleTalk support is built, loaded, or operationally required.
- Confirm the installed kernel contains the applicable cited fix commit.
- After updating, verify the fixed kernel is running following any required reboot.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38542 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/b92bedf71f25303e203a4e657489d76691a58119CVE reference, Linux
- https://git.kernel.org/stable/c/a7852b01793669248dce0348d14df89e77a32afdCVE reference, Linux
- https://git.kernel.org/stable/c/b2f5dfa87367fdce9f8b995bc6c38f64f9ea2c90CVE reference, Linux
- https://git.kernel.org/stable/c/d2e9f50f0bdad73b64a871f25186b899624518c4CVE reference, Linux
- https://git.kernel.org/stable/c/4a17370da6e476d3d275534e9e9cd2d02c57ca46CVE reference, Linux
- https://git.kernel.org/stable/c/473f3eadfc73b0fb6d8dee5829d19a5772e387f7CVE reference, Linux
- https://git.kernel.org/stable/c/64124cf0aab0dd1e18c0fb5ae66e45741e727f8bCVE reference, Linux
- https://git.kernel.org/stable/c/711c80f7d8b163d3ecd463cd96f07230f488e750CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.