CVE-2025-38458: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38458 is a NULL pointer dereference vulnerability in the Linux kernel's ATM (Asynchronous Transfer Mode) CLIP (Classical IP over ATM) subsystem, specifically in the vcc_sendmsg() function. The flaw exists because atmarpd_dev_ops does not implement a send method, causing a kernel crash when a send operation is attempted on the affected device. It affects Linux kernel versions from 2.6.13 up through 6.15.6 (with specific fixed versions across stable branches), as well as Debian Linux 11.0. Disclosed on July 25, 2025, it carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a missing function pointer (CWE-476: NULL Pointer Dereference) in the atmarpd_dev_ops structure, which lacks a send method implementation. When vcc_sendmsg() in net/atm/common.c (line 644) attempts to invoke the send operation on an ATM CLIP device, it dereferences a NULL function pointer, triggering a kernel oops. Exploitation requires a local attacker to open an ATM socket and invoke sendmsg() or sendmmsg() system calls targeting the affected device. The crash trace shows the call path: vcc_sendmsg → sock_sendmsg_nosec → __sock_sendmsg → ____sys_sendmsg, confirming the issue is reachable via standard socket system calls (Red Hat Bugzilla).

Successful exploitation causes a kernel NULL pointer dereference, resulting in a system crash (kernel oops/panic) and denial of service. The impact is limited to availability — there is no confidentiality or integrity impact. Affected systems using ATM networking with vulnerable kernel versions may experience unplanned reboots or service interruptions, potentially disrupting critical services running on the host (Red Hat Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The vulnerability requires low-privilege local access (authenticated user) and no user interaction, but is constrained to systems with ATM networking enabled — a relatively uncommon configuration in modern deployments. The EPSS score is 0.024% (very low probability of exploitation in the near term). It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Red Hat Advisory).

1. Identify target: Confirm the target system runs a vulnerable Linux kernel version (2.6.13–5.4.295, 5.5–5.10.239, 5.11–5.15.188, 5.16–6.1.145, 6.2–6.6.98, 6.7–6.12.38, or 6.13–6.15.6) with ATM networking support compiled in or loaded as a module.
2. Gain local access: Obtain a low-privilege shell on the target system (e.g., via SSH with a standard user account).
3. Open ATM socket: Use a program or script to create an ATM socket (e.g., socket(AF_ATM, SOCK_DGRAM, ...)) targeting the atmarpd device interface.
4. Trigger the crash: Invoke sendmsg() or sendmmsg() on the ATM socket, causing vcc_sendmsg() to attempt to call the missing send function pointer in atmarpd_dev_ops, resulting in a NULL pointer dereference and kernel panic (Red Hat Bugzilla).

• Logs: Kernel oops messages in /var/log/kern.log or dmesg output containing BUG: kernel NULL pointer dereference, address: 0000000000000000 with a call trace referencing vcc_sendmsg+0xa10/0xc50 net/atm/common.c:644.
• Logs: System log entries showing Oops: Oops: 0010 [#1] SMP KASAN NOPTI followed by register dumps and the ATM/socket call stack.
• Process: Unusual processes invoking sendmmsg or sendmsg system calls on ATM sockets, particularly from non-administrative users.
• System: Unexpected system reboots or kernel panics on hosts with ATM networking enabled (Red Hat Bugzilla).

Apply the patched kernel versions released for each stable branch: 5.4.296, 5.10.240, 5.15.189, 6.1.146, 6.6.99, 6.12.39, or 6.15.7 and later. Patches are available via the upstream Linux kernel stable tree and have been incorporated into vendor advisories for Debian (DSA-5975-1), Ubuntu (USN-7774-2, USN-7775-1, USN-7775-2, USN-7776-1, USN-7774-4, USN-7774-5, USN-7879-1 through USN-7879-4, USN-7880-1, USN-7934-1), SUSE, and Oracle Linux. As a workaround where immediate patching is not possible, disable or restrict access to ATM networking interfaces (e.g., blacklist the atm kernel module via /etc/modprobe.d/) and restrict local user access to minimize exposure (Red Hat Advisory, Red Hat Bugzilla).