VulnerabilityPublished 25 Jul 2025Updated 5 Nov 2026

CVE-2025-38458: Linux kernel · atm: clip: Fix NULL pointer dereference in vcc_sendmsg()

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in a16fbe6087e91c8e7c4aa50e1af7ad56edbd9e3e : update Linux kernel when convenient.

Data as of 5 Nov 2026, 21:19 UTC

Severity

Unrated

Rated by Threat Radar · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-05.

Patch

Available – fixed in a16fbe6087e91c8e7c4aa50e1af7ad56edbd9e3e, 34a09d6240a25185ef6fc5a19dbb3cdbb6a78bc0, 27b5bb7ea1a8fa7b8c4cfde4d2bf8650cca2e8e8 +5

Exploitation evidence

Disclosed: evidence found.
CVE published 25 Jul 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 5 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < a16fbe6087e91c8e7c4aa50e1af7ad56edbd9e3e	Fixed in a16fbe6087e91c8e7c4aa50e1af7ad56edbd9e3e
LinuxLinux	Affected ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 34a09d6240a25185ef6fc5a19dbb3cdbb6a78bc0	Fixed in 34a09d6240a25185ef6fc5a19dbb3cdbb6a78bc0
LinuxLinux	Affected ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 27b5bb7ea1a8fa7b8c4cfde4d2bf8650cca2e8e8	Fixed in 27b5bb7ea1a8fa7b8c4cfde4d2bf8650cca2e8e8
LinuxLinux	Affected ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 22fc46cea91df3dce140a7dc6847c6fcf0354505	Fixed in 22fc46cea91df3dce140a7dc6847c6fcf0354505
LinuxLinux	Affected ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 9ec7e943aee5c28c173933f9defd40892fb3be3d	Fixed in 9ec7e943aee5c28c173933f9defd40892fb3be3d
LinuxLinux	Affected ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 7f8a9b396037daae453a108faec5b28886361323	Fixed in 7f8a9b396037daae453a108faec5b28886361323

Description

In the Linux kernel, the following vulnerability has been resolved: atm: clip: Fix NULL pointer dereference in vcc_sendmsg() atmarpd_dev_ops does not implement the send method, which may cause crash as bellow. BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 0 P4D 0 Oops: Oops: 0010 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted 6.15.0-rc6-syzkaller-00346-g5723cc3450bc #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:0x0 Code: Unable to access opcode bytes at 0xffffffffffffffd6. RSP: 0018:ffffc9000d3cf778 EFLAGS: 00010246 RAX: 1ffffffff1910dd1 RBX: 00000000000000c0 RCX: dffffc0000000000 RDX: ffffc9000dc82000 RSI: ffff88803e4c4640 RDI: ffff888052cd0000 RBP: ffffc9000d3cf8d0 R08: ffff888052c9143f R09: 1ffff1100a592287 R10: dffffc0000000000 R11: 0000000000000000 R12: 1ffff92001a79f00 R13: ffff888052cd0000 R14: ffff88803e4c4640 R15: ffffffff8c886e88 FS: 00007fbc762566c0(0000) GS:ffff88808d6c2000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffffffffd6 CR3: 0000000041f1b000 CR4: 0000000000352ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> vcc_sendmsg+0xa10/0xc50 net/atm/common.c:644 sock_sendmsg_nosec net/socket.c:712 [inline] __sock_sendmsg+0x219/0x270 net/socket.c:727 ____sys_sendmsg+0x52d/0x830 net/socket.c:2566 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2620 __sys_sendmmsg+0x227/0x430 net/socket.c:2709 __do_sys_sendmmsg net/socket.c:2736 [inline] __se_sys_sendmmsg net/socket.c:2733 [inline] __x64_sys_sendmmsg+0xa0/0xc0 net/socket.c:2733 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xf6/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f

References

Community reviews

Loading reviews…