CVE-2025-38460: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38460 is a NULL pointer dereference vulnerability (CWE-476) in the Linux kernel's ATM (Asynchronous Transfer Mode) CLIP (Classical IP over ATM) subsystem, specifically in the to_atmarpd() function. The flaw arises because atmarpd is accessed without adequate locking — particularly from unsleepable contexts such as clip_neigh_solicit() / neigh_ops->solicit() — creating a race condition that can result in a null pointer dereference. Affected kernel versions span from 2.6.12 through multiple stable branches up to (but not including) 5.4.296, 5.10.240, 5.15.189, 6.1.146, 6.6.99, 6.12.39, and 6.15.7. It was published on July 25, 2025, with a CVSS v3.1 base score of 5.5 (Medium) (RedHat CVE, RedHat Bugzilla).

The root cause is insufficient synchronization when accessing the atmarpd pointer in to_atmarpd() (CWE-476: NULL Pointer Dereference). Although atmarpd was previously protected by the RTNL lock (since commit f3a0592b37b8), this protection is inadequate because to_atmarpd() can be called from unsleepable contexts — notably clip_neigh_solicit() via neigh_ops->solicit() — where acquiring RTNL is not possible, and there is no RTNL dependency around atmarpd itself. The fix replaces RTNL-based protection with a private mutex combined with RCU (Read-Copy-Update) to safely guard access to atmarpd in both sleepable and unsleepable contexts. The attack vector is local, requiring low privileges and no user interaction (RedHat CVE, Kernel Patches).

Successful exploitation allows a local, low-privileged user to trigger a null pointer dereference in the kernel's ATM CLIP subsystem, potentially causing system instability, a kernel panic, or a denial of service (DoS). There is no impact on confidentiality or integrity — the vulnerability is limited to availability (CVSS availability impact: High). The scope is confined to the local system; lateral movement or data exfiltration are not direct consequences of this vulnerability (RedHat CVE).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (RedHat CVE). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. No threat actor attribution has been reported.

Patches have been released for all affected stable Linux kernel branches. Administrators should update to the following fixed versions or later: 5.4.296, 5.10.240, 5.15.189, 6.1.146, 6.6.99, 6.12.39, 6.15.7, or 6.16-rc6. Distribution-specific updates are available from Debian (DSA-5975-1), Ubuntu (USN-7774, USN-7775, USN-7776, USN-7879, USN-7880, USN-7934), SUSE/openSUSE (SUSE-2025-03283, 03314, 03344, 03383), and Oracle Linux. As a compensating control where patching is not immediately possible, restricting local user access to the ATM networking subsystem and monitoring for unexpected kernel panics is advisable (RedHat CVE, Ubuntu USN-7774, Kernel Patches).