PT-2025-27960 · Linux+6 · Linux Kernel+6
Published
2025-06-16
·
Updated
2026-04-20
·
CVE-2025-38185
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions:
Linux kernel (affected versions not specified)
Description:
The issue is related to the
atmtcp c send() function in the Linux kernel, where it accesses skb->data as struct atmtcp hdr after checking if skb->len is 0, but this check is not sufficient. When skb->len equals 0, skb and sk (vcc) are leaked because dev kfree skb() is not called and sk wmem alloc adjustment is missing to revert atm account tx() in vcc sendmsg(). This leak occurs because the necessary cleanup is expected to be done in atm pop raw(), but it is not properly handled. The vulnerability was reported by syzbot, which identified the issue through a splat.Recommendations:
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
RCE
Memory Leak
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Astra Linux
Debian
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu