Infinite Recursion Vulnerability in Linux Kernel ATM Module

CVE-2025-38459

What is CVE-2025-38459?

A flaw in the ATM module of the Linux kernel allows for an infinite recursive call of the clip_push() function. This occurs when the ioctl(ATMARP_MKIP) command is issued multiple times, leading to improper handling of function pointers during socket operations. The vulnerability can cause a stack overflow due to excessive recursion and may impact system stability. Mitigations include implementing checks to prevent duplicate ioctl calls and utilizing locking mechanisms to avoid concurrent access issues.

References