CVE-2025-38180: net: atm: fix /proc/net/atm/lec handling
In the Linux kernel, the following vulnerability has been resolved:
net: atm: fix /proc/net/atm/lec handling
/proc/net/atm/lec must ensure safety against devlec[] changes.
It appears it had devput() calls without prior devhold(), leading to imbalance and UAF.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38180?
CVE-2025-38180 is classified as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2025-38180?
To fix CVE-2025-38180, update to the latest version of the Linux kernel where the vulnerability has been addressed.
What systems are affected by CVE-2025-38180?
CVE-2025-38180 affects all versions of the Linux kernel that handle dev_lec[] changes improperly.
What does CVE-2025-38180 exploit?
CVE-2025-38180 exploits a use-after-free vulnerability due to improper handling of device references in the Linux kernel.
Is CVE-2025-38180 a critical vulnerability?
CVE-2025-38180 is not considered critical but poses a risk that can lead to system instability.