CVE-2025-38245: Linux Kernel Race Condition Vulnerability

CVE-2025-38245 Overview

CVE-2025-38245 is a race condition vulnerability in the Linux kernel's Asynchronous Transfer Mode (ATM) subsystem. The flaw resides in the atm_dev_deregister() function within net/atm/resources.c. The function releases atm_dev_mutex immediately after removing a device from the device list, but before removing the associated procfs and sysfs entries.

This creates a race window where a concurrent call to atm_dev_register() can attempt to register a procfs entry with a name that still exists, triggering a kernel warning at fs/proc/generic.c:377. The issue was reported by syzbot during fuzzing of atm_dev_register().

Critical Impact
A local, low-privileged attacker can trigger the race condition through the atmtcp ioctl interface, causing kernel warnings and potential compromise of confidentiality, integrity, and availability of the affected system.

Affected Products

Linux Kernel (multiple stable and long-term branches, including 6.16-rc1 through 6.16-rc3 and versions going back to 2.6.15)
Debian Linux 11.0
Distributions shipping the affected kernel branches without the fix

Discovery Timeline

2025-07-09 - CVE-2025-38245 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-38245

Vulnerability Analysis

The vulnerability is a race condition [CWE-362] in the ATM device deregistration path. When atm_dev_register() creates a new device, it first calls __atm_dev_lookup() under atm_dev_mutex to detect duplicates, then creates procfs and sysfs entries for the device. All of this occurs while the mutex is held.

The defect appears in the symmetric deregistration path. atm_dev_deregister() removes the device from the shared list, then releases atm_dev_mutex before tearing down procfs and sysfs artifacts. Between the mutex release and the procfs cleanup, a concurrent registration path can lookup the list, find no duplicate, and attempt to create a procfs entry with a colliding name such as atm/atmtcp:0.

The collision reaches proc_register() in fs/proc/generic.c, which emits the warning proc_dir_entry 'atm/atmtcp:0' already registered. Depending on kernel configuration and adjacent state, the race can lead to memory corruption or use-after-free style behaviors in kernel data structures tied to the stale procfs entries.

Root Cause

The root cause is asymmetric locking scope between registration and deregistration. atm_dev_register() holds atm_dev_mutex across both the lookup and the procfs/sysfs creation. atm_dev_deregister() releases the mutex too early, before removing the procfs/sysfs entries, breaking the invariant that a device on the list and its filesystem entries are mutually consistent.

Attack Vector

Exploitation requires local access with the ability to open an ATM socket and issue ioctls to the atmtcp driver. The attack flow uses atmtcp_attach via atmtcp_ioctl() to trigger atm_dev_register() in one thread while another thread concurrently drives atm_dev_deregister(). The window between mutex release and procfs teardown is small, but reliably reachable via syscall fuzzing patterns similar to those used by syzbot. No user interaction is required and no network access is needed.

The published Linux commits, such as 4bb1bb438134d9ee6b97cc07289dd7c569092eec and the related backports, describe the reproducer and the fix in detail. See the Kernel Git Commit Update for the authoritative patch.

No public proof-of-concept exploit code is available beyond the syzbot reproducer referenced in the commit messages.

Detection Methods for CVE-2025-38245

Indicators of Compromise

Kernel log warnings containing proc_dir_entry 'atm/atmtcp:already registered originating from proc_register+0x455/0x5f0 in fs/proc/generic.c:377.
Stack traces showing atm_proc_dev_register, atm_dev_register, atmtcp_create, and atmtcp_ioctl on the same call chain.
Unexpected kernel taints or oopses on hosts that do not normally load the atm or atmtcp modules.

Detection Strategies

Monitor dmesg and /var/log/kern.log for WARNING: CPU: messages tied to proc_register in the ATM subsystem.
Alert on process creation patterns where non-administrative users load or interact with atmtcp, atm, or open AF_ATMPVC/AF_ATMSVC sockets.
Baseline expected kernel modules per host and flag runtime loads of ATM-related modules (atm, atmtcp, br2684).

Monitoring Recommendations

Ingest kernel ring buffer messages into a centralized logging pipeline and add detections for the specific procfs collision warning string.
Track ioctl calls with request code 0x6180 (the ATMTCP_CREATE family) issued by unprivileged UIDs.
Correlate unexpected socket creation with AF_ATMPVC against process lineage to identify local exploitation attempts.

How to Mitigate CVE-2025-38245

Immediate Actions Required

Apply the upstream stable kernel updates that hold atm_dev_mutex until procfs and sysfs entries are removed in atm_dev_deregister().
On Debian systems, install the kernel updates referenced in the Debian LTS Advisory Notice and the companion Debian LTS Advisory.
Restrict local shell access on multi-tenant systems until patched kernels are deployed.

Patch Information

The fix moves the mutex_unlock(&atm_dev_mutex) in atm_dev_deregister() to after procfs and sysfs removal, restoring the locking symmetry with atm_dev_register(). Patches are available across stable branches via commits including 26248d5d68c865b888d632162abbf8130645622c, 2a8dcee649d12f69713f2589171a1caf6d4fa439, 4bb1bb438134d9ee6b97cc07289dd7c569092eec, 6922f1a048c090f10704bbef4a3a1e81932d2e0a, a433791aeaea6e84df709e0b9584b9bbe040cd1c, ae539d963a17443ec54cba8a767e4ffa318264f4, b2e40fcfe1575faaa548f87614006d3fe44c779e, and cabed6ba92a9a8c09da02a3f20e32ecd80989896.

Workarounds

Blacklist the atmtcp and atm kernel modules on hosts that do not require ATM support by adding install atmtcp /bin/true and install atm /bin/true to /etc/modprobe.d/.
Remove or restrict access to CAP_NET_ADMIN for untrusted local users, since ATM device creation ultimately depends on privileged operations combined with socket access.
Rebuild custom kernels without CONFIG_ATM and CONFIG_ATM_TCP where the ATM subsystem is not needed.

bash

# Configuration example: disable ATM modules on hosts that do not need them
echo 'install atm /bin/true'    | sudo tee /etc/modprobe.d/disable-atm.conf
echo 'install atmtcp /bin/true' | sudo tee -a /etc/modprobe.d/disable-atm.conf
sudo depmod -a
# Verify modules are not currently loaded
lsmod | grep -E '^(atm|atmtcp)\b' || echo 'ATM modules not loaded'