CVE-2025-38180: Linux Kernel Use-After-Free Vulnerability

CVE-2025-38180 Overview

CVE-2025-38180 is a use-after-free vulnerability [CWE-416] in the Linux kernel's Asynchronous Transfer Mode (ATM) LAN Emulation (LEC) subsystem. The flaw resides in the handling of /proc/net/atm/lec, which fails to protect against concurrent modifications of the dev_lec[] array. Missing dev_hold() calls paired with existing dev_put() invocations create a reference count imbalance, leading to premature release of net_device structures and subsequent use-after-free conditions. A local, low-privileged attacker can trigger the flaw through normal filesystem access to /proc.

Critical Impact
Local attackers with low privileges can trigger memory corruption in kernel space, enabling privilege escalation, kernel information disclosure, or denial of service on affected Linux systems.

Affected Products

Linux Kernel (from 2.6.12 through 6.16-rc2, multiple stable branches)
Debian Linux 11.0
Distributions shipping vulnerable stable/LTS kernel builds

Discovery Timeline

2025-07-04 - CVE-2025-38180 published to the National Vulnerability Database
2025-10 - Debian LTS advisories published referencing this issue
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2025-38180

Vulnerability Analysis

The vulnerability affects the ATM LAN Emulation code path exposed through the /proc/net/atm/lec procfs interface. When user space reads this file, the kernel iterates over the dev_lec[] device array to render device information. The iteration logic invokes dev_put() on referenced net_device structures without a preceding dev_hold(), causing the reference counter to decrement below the expected value.

Once the reference counter reaches zero prematurely, the kernel can free the underlying net_device while other code paths retain pointers to it. Any subsequent dereference operates on freed memory, producing a classic use-after-free condition inside kernel address space. Concurrent modifications to dev_lec[] amplify the race window.

Root Cause

The root cause is a reference counting imbalance in the procfs handler for ATM LEC. The code path calls dev_put() to release a device reference that was never acquired via dev_hold(). This missing acquire step breaks the invariant expected by the Linux networking device layer, which relies on symmetric hold/put semantics to keep net_device objects alive during use.

Attack Vector

Exploitation requires local access with low privileges. An attacker reads /proc/net/atm/lec while triggering changes to the ATM LEC device table. The race can be repeated to shape the kernel heap and place attacker-controlled data into the freed slot. Successful exploitation can lead to kernel memory corruption, information disclosure of adjacent kernel data, or elevation of privilege to root. The ATM LEC subsystem must be compiled and loadable for the target system to be exposed.

No public proof-of-concept exploit is currently listed for CVE-2025-38180, and the vulnerability is not on the CISA Known Exploited Vulnerabilities catalog. See the upstream commit references for technical details of the fix.

Detection Methods for CVE-2025-38180

Indicators of Compromise

Kernel oops or panic messages referencing lec_seq_*, atm_lane, or net_device reference counting in dmesg and /var/log/kern.log
Unexpected KASAN (Kernel Address Sanitizer) reports citing use-after-free in the ATM LEC code path
Presence of loaded lec or atm kernel modules on systems that do not require ATM networking

Detection Strategies

Inventory running kernel versions and compare against the fixed stable releases referenced in the kernel.org commit list
Audit lsmod output across the fleet for the lec module and flag hosts where ATM emulation is not operationally required
Correlate unprivileged process reads of /proc/net/atm/lec with subsequent kernel warnings using host telemetry

Monitoring Recommendations

Forward kernel ring buffer messages to a centralized logging platform and alert on refcount_t warnings, general protection fault, or use-after-free strings
Track process access to procfs entries under /proc/net/atm/ from non-root UIDs
Monitor for kernel module load events involving atm, lec, or related networking modules on production servers

How to Mitigate CVE-2025-38180

Immediate Actions Required

Apply vendor-provided kernel updates that include the upstream fix commits referenced by kernel.org
Restrict local shell access on multi-tenant systems and enforce least-privilege for interactive user accounts
Where ATM LEC is not required, blacklist the lec and related ATM kernel modules to remove the attack surface

Patch Information

The fix is available in multiple stable branches through the commits listed on kernel.org, including fcfccf56f4eb, e612c4b014f5, d03b79f459c7, ca3829c18c8d, a5e3a1442688, 9b9aeb3ada44, f2d1443b1880, and 5fe1b23a2f87. Debian users should apply the packages announced in the Debian LTS advisories from October 2025. Reboot affected systems after installing the updated kernel package.

Workarounds

Blacklist the lec module in /etc/modprobe.d/ on systems that do not use ATM LAN Emulation
Remove read permissions on /proc/net/atm/lec from unprivileged users via mount options or namespace isolation where feasible
Deploy mandatory access control profiles (SELinux, AppArmor) that restrict access to ATM procfs entries

bash

# Configuration example - blacklist the vulnerable ATM LEC module
echo "blacklist lec" | sudo tee /etc/modprobe.d/blacklist-atm-lec.conf
echo "blacklist atm" | sudo tee -a /etc/modprobe.d/blacklist-atm-lec.conf
sudo depmod -a
sudo update-initramfs -u
# Verify the module is not loaded after reboot
lsmod | grep -E "^(lec|atm)\b"