Kernel vulnerability affecting Linux ATM subsystem by Linux Foundation

CVE-2025-39828

What is CVE-2025-39828?

A vulnerability exists within the Linux kernel's ATM subsystem that allows for arbitrary writes due to insufficient validation of message lengths during certain send operations. This flaw can be exploited when the atmtcp_recv_control() function is called, facilitating unauthorized modifications of kernel pointers. The issue stems from a user-space manipulation leading to potential system instability and security risks, as the lack of checks permits malicious actors to corrupt memory space, compromising system integrity. Developers are encouraged to apply the patch to avoid exploitation.

References