CVE-2025-38185: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38185 is a vulnerability discovered in the Linux kernel's ATM TCP implementation. The issue was identified and disclosed on July 4, 2025, affecting the atmtcp subsystem. The vulnerability involves improper handling of socket buffer (skb) length validation in the atmtcpcsend() function (NVD, CVE).

The vulnerability occurs in the atmtcpcsend() function where skb->data is accessed as struct atmtcphdr after an insufficient length check. When skb->len is 0, both the skb and sk (vcc) resources are leaked because devkfreeskb() is not called and skwmemalloc adjustment is missing to revert atmaccounttx() in vccsendmsg(). This was expected to be handled in atmpopraw() (Debian Tracker).

The vulnerability can lead to resource leaks in the Linux kernel's ATM TCP implementation when processing network packets with specific conditions. This could potentially affect system stability and resource availability (NVD).

The issue has been resolved in the Linux kernel by properly freeing skb with invalid length in atmtcpcsend(). Fixed versions include Linux 6.12.35-1 in Debian trixie and 6.12.37-1 in Debian sid (Debian Tracker).