Memory Leak Vulnerability in Linux Kernel - ATM Clip Module
Summary
CVE-2025-38546: In the Linux kernel, the following vulnerability has been resolved: atm: clip: Fix memory leak of struct clip_vcc. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing the essential interface between hardware and software. It manages system resources, facilitates communication between hardware and software, and ensures system stability. The ATM (Asynchronous Transfer Mode) subsystem within the Linux kernel is responsible for managing ATM networks. The ATM clip module specifically handles the connection and management of ATM virtual circuits. This vulnerability affects the memory management within this module, potentially leading to resource exhaustion.
Vulnerability Detail
In the Linux kernel, a memory leak vulnerability has been identified in the ATM clip module. This issue arises from the improper handling of memory allocation during the execution of the ioctl(ATMARP_MKIP) function, which allocates a struct clip_vcc. The vulnerability occurs when the vcc_destroy_socket() function fails to properly free the allocated memory due to a NULL pointer being set in the vcc->push() method during the initialization of the ATMARP control. This oversight can lead to a memory leak, which may degrade system performance over time and potentially cause denial of service.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is advisable to apply the patch as soon as it is available to mitigate the risk.
Conclusion
The CVE-2025-38546 vulnerability in the Linux kernel's ATM clip module poses a significant risk due to memory leaks. Users are encouraged to update their systems to the latest patched versions to ensure system stability and security. Regular monitoring for vulnerabilities using tools like Vulert can help maintain awareness and prompt action.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38546 is a memory leak vulnerability in the ATM clip module of the Linux kernel, which can lead to resource exhaustion.
This vulnerability can cause memory leaks, potentially degrading system performance and leading to denial of service over time.
Versions of the Linux kernel in Debian 11 and Debian 14 are affected, while Debian 12 and 13 have patched versions available.
You can use Vulert, which monitors and alerts for open-source vulnerabilities. Check your application using the Vulert playground at Vulert Scanner.
While there are no specific workarounds, it is crucial to plan for an update to the patched version as soon as possible to mitigate risks.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
