CVE-2025-22004

What it actually does

Use-after-free in lec_send() where the skb length is read after the ->send() operation has freed the buffer in the Linux kernel ATM subsystem.

Why it matters to the business

Kernel instability, crashes, or potential privilege escalation on Linux systems using ATM networking; high urgency for patching given multiple related kernel privilege-escalation campaigns and widespread RHEL enterprise deployments.

How an attack unfolds

An attacker triggers the lec_send path (via local or network-induced ATM traffic), relies on the send operation freeing the skb, then reuses the dangling reference for memory corruption and privilege escalation, consistent with observed patterns in related Linux kernel exploits by threat actors targeting similar CVEs.

How to fix it

Update the Linux kernel to commit 50e288097c2c6e5f374ae079394436fc29d1e88e in the stable tree; for affected Red Hat packages apply the listed fixed versions such as dotnet 0:5.0.203-1.el8_4, dotnet-host 0:5.0.6-1.el8_4, and equivalent updates for all listed dotnet components on RHEL 8.

How to confirm the fix worked

Confirm the running kernel contains commit 50e288097c2c6e5f374ae079394436fc29d1e88e or verify package versions match the supplied fixed releases; test ATM interface functionality post-update.

Typical attack path

1. Gain access to a system with ATM networking enabled
2. Craft conditions or packets that invoke lec_send()
3. Allow ->send() to free the skb
4. Access the freed buffer to corrupt kernel memory
5. Escalate privileges or cause denial of service

How to detect it

Search kernel logs and crash dumps for references to lec_send and use-after-free patterns; correlate with ATM interface activity and compare against known exploit patterns from related kernel privilege-escalation CVEs.

What your security team should do

• Immediately apply the kernel commit or listed package updates due to 573 days since publication and related privilege-escalation activity
• Audit systems for ATM usage and disable if unnecessary
• Monitor kernel logs for UAF-related oops in lec_send
• Prioritize patching of high-value Linux hosts given ecosystem prevalence