Null Pointer Dereference Vulnerability in Linux Kernel ATM Module

CVE-2025-38460

What is CVE-2025-38460?

A vulnerability exists in the Linux kernel's ATM module, specifically related to the atmarpd function. The issue arises when to_atmarpd() is called without proper RTNL (Route Networking Lock) protection, which can lead to potential null pointer dereference during operations such as clip_neigh_solicit(). This improper handling can manifest vulnerabilities in network stability and security. A fix was introduced to utilize a private mutex and RCU (Read-Copy-Update) for appropriate synchronization and protection around atmarpd, aiming to mitigate these risks.

References