CVE-2025-38180

What it actually does

Missing dev_hold() before dev_put() on dev_lec[] entries in /proc/net/atm/lec procfs handler creates reference count imbalance that triggers use-after-free on subsequent access or module unload.

Why it matters to the business

Linux systems using ATM interfaces face kernel memory corruption risk that can cause crashes, denial of service, or local privilege escalation; high prevalence in server and embedded distributions increases exposure surface.

How an attack unfolds

An attacker with local access reads or iterates /proc/net/atm/lec while concurrent device changes occur, dereferences a freed net_device structure, and leverages the UAF for arbitrary read/write or code execution; listed threat actors have chained similar Linux kernel UAFs for privilege escalation.

How to fix it

Apply the upstream fix in commit fcfccf56f4eba7d00aa2d33c7bb1b33083237742 or upgrade to a kernel containing that change; rebuild and reboot all affected systems; for packaged distributions apply the corresponding vendor update such as oauth2-proxy-fips 7.9.0-r1 when applicable.

How to confirm the fix worked

Verify the running kernel contains commit fcfccf56f4eba7d00aa2d33c7bb1b33083237742 via git log or package version; confirm /proc/net/atm/lec handler no longer performs unbalanced dev_put calls through code review or dynamic tracing.

Typical attack path

1. Obtain local shell on target Linux system
2. Open or read /proc/net/atm/lec to trigger proc handler
3. Race with net device registration or removal to hit freed object
4. Use UAF primitive to corrupt kernel structures or redirect execution
5. Escalate to root or install persistence

How to detect it

Search kernel logs for unbalanced device reference warnings, slab UAF reports referencing net_device or lec structures, and unexpected crashes during procfs reads of atm interfaces; correlate with process activity touching /proc/net/atm/lec.

What your security team should do

• Patch all Linux kernels to the fixed commit within 30 days given EPSS trend and similar recent kernel exploits
• Restrict unprivileged access to /proc/net/atm/* via mount options or SELinux policies until patched
• Monitor for new Linux kernel privilege-escalation tooling that targets ATM procfs entries
• Include this UAF class in kernel fuzzing and static analysis pipelines