Memory Leak in Linux Kernel ATM Component

CVE-2025-38546

What is CVE-2025-38546?

A vulnerability in the Linux kernel's ATM subsystem leads to a memory leak involving the struct clip_vcc. This issue arises when the ioctl(ATMARP_MKIP) function allocates the struct clip_vcc and assumes that the corresponding socket closure procedure vcc_destroy_socket() will handle this correctly. However, a flaw in the implementation causes a situation where the vcc->push() is not reset correctly, resulting in a memory leak. To resolve this, the code should serialize two ioctl calls using lock_sock() and implement a check for vcc->push() during the initialization phase to prevent further memory leakage.

References