Critical NULL Pointer Dereference in Linux Kernel: CVE-2025-38458
Summary
CVE-2025-38458: In the Linux kernel, the following vulnerability has been resolved: atm: clip: Fix NULL pointer dereference in vcc_sendmsg() atmarpd_dev_ops does not implement the send method, which may cause crash as bellow. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, responsible for managing hardware resources and providing essential services to software applications. It supports a wide range of functionalities, including process management, memory management, and device control. This vulnerability affects the Linux kernel versions in Debian distributions, specifically Debian 11, 12, and 13, which are widely used in server and desktop environments.
Vulnerability Detail
CVE-2025-38458 is a critical vulnerability in the Linux kernel that arises from a NULL pointer dereference in the ATM subsystem, specifically in the vcc_sendmsg() function. This issue occurs because the atmarpd_dev_ops does not implement the send method, leading to potential crashes when the function is invoked. The vulnerability can result in a kernel panic, causing the system to become unresponsive and requiring a reboot. The technical details indicate that the dereference of a NULL pointer can lead to unpredictable behavior and security risks, particularly in environments where stability is crucial.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the ATM subsystem if it is not required for their applications. This can be done by blacklisting the ATM module in the kernel. To do this, add the following line to the /etc/modprobe.d/blacklist.conf file:
blacklist atm
Then, update the initramfs:
sudo update-initramfs -u
Reboot the system for the changes to take effect.
Conclusion
CVE-2025-38458 is a significant vulnerability in the Linux kernel that can lead to system instability. It is crucial for users of Debian 11, 12, and 13 to update their systems to the latest patched versions to ensure security and stability. Temporary workarounds are available, but updating is the recommended solution.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38458 is a vulnerability in the Linux kernel that can cause a NULL pointer dereference, potentially leading to system crashes.
This vulnerability can lead to kernel panics, causing your system to become unresponsive and requiring a reboot, which can disrupt services and applications.
Debian 11, 12, and 13 are affected by this vulnerability in the Linux kernel.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If an immediate update is not possible, consider disabling the ATM subsystem as a temporary workaround to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
