CVE-2025-38460

What it actually does

Potential null pointer dereference in to_atmarpd() due to insufficient locking around atmarpd access outside RTNL, particularly from unsleepable paths like clip_neigh_solicit via neigh_ops->solicit, allowing concurrent access without protection.

Why it matters to the business

Kernel crashes or instability on systems using legacy ATM networking, leading to denial of service and unplanned downtime; low prevalence reduces overall exposure but requires kernel updates on affected Debian systems.

How an attack unfolds

An attacker with local or network access triggering neighbor solicitation in the CLIP ATM module races the atmarpd pointer access before the private mutex and RCU protections are applied, causing a null dereference and kernel panic.

How to fix it

Upgrade linux package on Debian 12 to version 6.1.147-1 or later; apply kernel updates across all affected distributions; consider disabling unused ATM/CLIP functionality if patching is delayed.

How to confirm the fix worked

Confirm kernel version is at or above the fixed release; review source for addition of private mutex and RCU guards around atmarpd in to_atmarpd(); test neighbor solicitation paths under load.

Typical attack path

1. Identify system with ATM CLIP enabled and vulnerable kernel
2. Trigger clip_neigh_solicit or equivalent neigh_ops solicit call without RTNL held
3. Race concurrent access to atmarpd to induce null pointer dereference
4. Cause kernel panic or undefined behavior for denial of service

How to detect it

Review kernel logs for null pointer dereference oops in atm/clip or to_atmarpd paths; examine system call traces involving neighbor solicitation on ATM interfaces; check for unexpected reboots correlating with ATM traffic.

What your security team should do

• Prioritize kernel upgrade to 6.1.147-1 on all Debian 12 systems within maintenance windows
• Audit for ATM/CLIP usage and disable if not required
• Monitor EPSS trend and any new exploit reports given modest increase
• Incorporate into regular kernel update cadence to address similar race conditions