CVE-2025-22004 Overview
CVE-2025-22004 is a use-after-free vulnerability [CWE-416] in the Linux kernel's Asynchronous Transfer Mode (ATM) LAN Emulation (LEC) subsystem. The flaw resides in the lec_send() function within net/atm/lec.c. The ->send() callback frees the socket buffer (skb) before the caller reads its length, producing a use-after-free condition. A local attacker with low privileges can trigger the freed memory access to corrupt kernel memory, disclose sensitive information, or escalate privileges. The vulnerability affects multiple Linux kernel branches, including release candidates for 6.14. Upstream maintainers resolved the issue by saving the skb length prior to invoking ->send().
Critical Impact
Local exploitation of the freed skb pointer can lead to kernel memory corruption, privilege escalation, and full compromise of confidentiality, integrity, and availability on affected Linux systems.
Affected Products
- Linux kernel stable branches prior to the fix commits
- Linux kernel 6.14 release candidates (rc1, rc2, rc3, rc4)
- Debian LTS distributions shipping affected kernel packages
Discovery Timeline
- 2025-04-03 - CVE-2025-22004 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-22004
Vulnerability Analysis
The defect exists in the ATM LAN Emulation code path exercised when the kernel transmits frames through a LEC device. Inside lec_send(), the driver calls the ATM virtual circuit's ->send() operation, which consumes and frees the skb. The original code then referenced skb->len to update transmit statistics, dereferencing memory that the send path had already released. This mismatch between object lifetime and post-call access is a classic use-after-free pattern in Linux network drivers.
Because the skb allocator can quickly recycle the freed slab object, a local attacker who controls network traffic on the LEC interface can spray the slab to place attacker-controlled data at the freed address. Subsequent reads of skb->len may return manipulated values, and adjacent field accesses can be pivoted into more powerful kernel primitives.
Root Cause
The root cause is unsafe ordering of operations around a transferred pointer. The ->send() callback assumes ownership of skb and releases it, yet lec_send() continued to read fields from the same pointer afterward. The upstream fix caches the skb length in a local variable before the callback executes, then uses that cached value for statistics.
Attack Vector
Exploitation requires local access with low privileges (AV:L/PR:L) and no user interaction. An attacker with the ability to send traffic through an ATM LEC interface can trigger the vulnerable code path repeatedly, shaping the SLUB freelist to place controlled data into the freed skb. Successful exploitation yields high impact to confidentiality, integrity, and availability, consistent with kernel-level compromise.
No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2025-22004
Indicators of Compromise
- Unexpected kernel oops or panic traces referencing lec_send, atm_lane, or skb->len accesses after kfree_skb
- KASAN reports flagging use-after-free reads within net/atm/lec.c
- Unexplained loading of the lec or atm kernel modules on hosts that do not use ATM networking
Detection Strategies
- Enable Kernel Address Sanitizer (KASAN) on test kernels to surface use-after-free accesses in the ATM LEC path during fuzzing
- Audit installed kernel packages against fix commits 326223182e47, 51e8be9578a2, 9566f6ee13b1, f3009d0d6ab7, and f3271f754838 published on git.kernel.org
- Monitor /proc/modules and lsmod output for the presence of lec or ATM modules on production systems
Monitoring Recommendations
- Forward kernel ring buffer (dmesg) and journalctl -k output to a centralized log platform for kernel crash analytics
- Alert on repeated segmentation faults or kernel warnings originating from ATM subsystem symbols
- Track privileged local process activity that opens raw ATM sockets or interacts with LEC interfaces
How to Mitigate CVE-2025-22004
Immediate Actions Required
- Apply the latest stable kernel updates from your Linux distribution vendor that include the upstream fix for lec_send()
- Debian LTS users should install the kernel packages referenced in the Debian LTS May 2025 announcement (msg00030) and Debian LTS May 2025 announcement (msg00045)
- Blacklist the ATM LEC modules on systems that do not require ATM networking to remove the attack surface
Patch Information
The upstream fix caches the skb length before invoking ->send(). Fix commits are available at kernel.org commit 326223182e47, commit 51e8be9578a2, commit 9566f6ee13b1, commit f3009d0d6ab7, and commit f3271f754838. Distributions have backported these patches into stable kernel series.
Workarounds
- Prevent automatic loading of the vulnerable modules by adding blacklist lec and blacklist atm entries under /etc/modprobe.d/
- Restrict access to raw ATM sockets by tightening capabilities such as CAP_NET_ADMIN and CAP_NET_RAW on untrusted local accounts
- Enforce mandatory access controls via SELinux or AppArmor policies that deny unprivileged users from interacting with ATM LEC interfaces
# Blacklist ATM LEC modules to eliminate the vulnerable code path
echo "blacklist lec" | sudo tee /etc/modprobe.d/disable-atm-lec.conf
echo "blacklist atm" | sudo tee -a /etc/modprobe.d/disable-atm-lec.conf
# Unload modules if currently loaded
sudo modprobe -r lec 2>/dev/null
sudo modprobe -r atm 2>/dev/null
# Regenerate initramfs so blacklist persists across reboots
sudo update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
