Critical Null Pointer Dereference Vulnerability in Linux Kernel (CVE-2025-38460)
Summary
CVE-2025-38460: In the Linux kernel, the following vulnerability has been resolved: atm: clip: Fix potential null-ptr-deref in to_atmarpd(). Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interactions. It is known for its stability, performance, and security features. However, like any complex software, it can have vulnerabilities. CVE-2025-38460 affects the ATM subsystem, specifically the clip driver, which is responsible for managing ATM (Asynchronous Transfer Mode) network connections. This vulnerability could lead to system instability or crashes if exploited.
Vulnerability Detail
In the Linux kernel, a null pointer dereference vulnerability has been identified in the ATM subsystem, specifically in the function to_atmarpd(). This function is called without proper protection, leading to a potential crash if a null pointer is dereferenced. The vulnerability arises because the function clip_neigh_solicit() is unsleepable and lacks the necessary RTNL (Routing Netlink) protection. If exploited, this could result in denial of service or system crashes, affecting the overall stability of systems running the vulnerable kernel versions.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the ATM subsystem if it is not needed for their applications. This can be done by blacklisting the ATM module in the kernel configuration or by removing the ATM-related packages from the system.
Conclusion
CVE-2025-38460 is a critical vulnerability in the Linux kernel that poses a risk of system crashes due to a null pointer dereference. Users are advised to update their kernel to the latest patched version to ensure system stability and security. Temporary workarounds are available for those unable to update immediately.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38460 is a vulnerability in the Linux kernel that can lead to a null pointer dereference, potentially causing system crashes.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
Exploitation of this vulnerability could lead to denial of service, causing system instability or crashes.
Yes, a patched version of the Linux kernel is available. Users should update their kernel to the latest version to mitigate the vulnerability.
As a temporary measure, consider disabling the ATM subsystem if it is not essential for your applications.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
