CVE-2025-22018: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-22018 is a vulnerability discovered in the Linux kernel's ATM subsystem, specifically related to a NULL pointer dereference issue. The vulnerability was disclosed on April 16, 2025, affecting the Linux kernel's MPOA (Multi-Protocol Over ATM) functionality (NVD).

The vulnerability occurs in the MPOAcacheimposrcvd() function when it receives a message where both 'entry' and 'holdingtime' parameters are NULL. The function fails to properly validate these parameters, leading to a NULL pointer dereference when the entry is passed to egcacheput(). This vulnerability has been assigned a CVSS v3 base score of 5.5, indicating moderate severity (Rapid7).

The vulnerability can lead to a system crash through a NULL pointer dereference, potentially causing a denial of service condition. The issue affects systems running vulnerable versions of the Linux kernel with ATM functionality enabled (Debian Security).

The vulnerability has been fixed in several Linux distributions. Debian has released patches in version 6.1.133-1 for bookworm and 6.12.22-1 for trixie. The fix is also available in version 6.12.25-1 for sid. Users are advised to upgrade to these patched versions (Debian Security).