FlawAtlas
Search the atlas
CVE-2025-38546 Not scored

atm: clip: Fix memory leak of struct clip_vcc.

In the Linux kernel, the following vulnerability has been resolved: atm: clip: Fix memory leak of struct clip_vcc. ioctl(ATMARP_MKIP) allocates struct clip_vcc and set it to vcc->user_back. The code assumes that vcc_destroy_socket() passes NULL skb to vcc->push() when the socket is close()d, and then clip_push() frees clip_vcc. However, ioctl(ATMARPD_CTRL) sets NULL to vcc->push() in atm_init_atmarp(), resulting in memory leak. Let's serialise two ioctl() by lock_sock() and check vcc->push() in atm_init_atmarp() to prevent memleak.

Exploit probability 0.2%
Published August 16, 2025
Required by Not available
Last source change July 15, 2026

02 / AFFECTED SOFTWARE

Affected packages

Linux Kernel
Unknown Unknown

1880 explicit affected versions

03 / CONNECTIONS

Connected vulnerabilities

related OPENSUSE-SU-2025:20081-1
related SUSE-SU-2025:03204-1
related SUSE-SU-2025:03272-1
related SUSE-SU-2025:03283-1
related SUSE-SU-2025:03290-1
related SUSE-SU-2025:03301-1
related SUSE-SU-2025:03310-1
related SUSE-SU-2025:03314-1
related SUSE-SU-2025:03344-1
related SUSE-SU-2025:03382-1
related SUSE-SU-2025:03383-1
related SUSE-SU-2025:03384-1
related SUSE-SU-2025:03602-1
related SUSE-SU-2025:03633-1
related SUSE-SU-2025:03634-1
related SUSE-SU-2025:20653-1
related SUSE-SU-2025:20669-1
related SUSE-SU-2025:20739-1
related SUSE-SU-2025:20756-1
related SUSE-SU-2025:21074-1
related SUSE-SU-2025:21139-1
related SUSE-SU-2025:21179-1

04 / EVIDENCE

Source records

Open Source Vulnerabilities CVE-2025-38546

In the Linux kernel, the following vulnerability has been resolved: atm: clip: Fix memory leak of struct clip_vcc. ioctl(ATMARP_MKIP) allocates struct clip_vcc and set it to vcc->user_back. The code assumes that vcc_destroy_socket() passes NULL skb to vcc->push() when the socket is close()d, and then clip_push() frees clip_vcc. However, ioctl(ATMARPD_CTRL) sets NULL to vcc->push() in atm_init_atmarp(), resulting in memory leak. Let's serialise two ioctl() by lock_sock() and check vcc->push() in atm_init_atmarp() to prevent memleak.

View original source

05 / REFERENCES

Further evidence