CVE-2025-38323: Linux Kernel Use-After-Free Vulnerability

CVE-2025-38323 Overview

CVE-2025-38323 is a use-after-free vulnerability [CWE-416] in the Linux kernel's Asynchronous Transfer Mode (ATM) LAN Emulation (LEC) subsystem, located in net/atm/lec.c. The syzbot fuzzing infrastructure identified an error path in lecd_attach() that could leave a dangling pointer in the dev_lec[] array. Concurrent calls to lecd_attach(), lec_vcc_attach(), and lec_mcast_attach() can access freed memory, producing a KASAN slab-use-after-free condition. The fix introduces a new lec_mutex to serialize access to dev_lec[]. Affected systems include the mainline Linux kernel and Debian Linux distributions shipping vulnerable kernel builds.

Critical Impact
A local attacker with the ability to issue ATM ioctl calls can trigger memory corruption in kernel space, leading to privilege escalation or denial of service.

Affected Products

Linux Kernel (multiple branches through 6.16-rc2)
Linux Kernel 2.6.12 (initial affected baseline)
Debian Linux 11.0

Discovery Timeline

2025-07-10 - CVE-2025-38323 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-38323

Vulnerability Analysis

The vulnerability resides in the ATM LEC subsystem, which emulates Ethernet or Token Ring LANs over ATM networks. The lecd_attach() function in net/atm/lec.c allocates a net_device via alloc_netdev_mqs() and stores a reference in the global dev_lec[] array. When lecd_attach() encounters an error after allocation, it calls free_netdev() but does not clear the corresponding dev_lec[] slot. The array retains a pointer to freed memory.

Subsequent ioctl calls routed through lane_ioctl() dereference the stale entry, producing a slab-use-after-free at net/atm/lec.c:751. KASAN reports the read of size 8 at the freed net_device address. Because the LEC device array was accessed without synchronization, concurrent attach and ioctl operations can race and reach freed objects.

Root Cause

The root cause is twofold: (1) an error path in lecd_attach() that frees a net_device without invalidating its slot in dev_lec[], and (2) absence of locking around access to dev_lec[] from lecd_attach(), lec_vcc_attach(), and lec_mcast_attach(). The patch adds lec_mutex to serialize these paths and ensure that the array cannot be observed in an inconsistent state.

Attack Vector

Exploitation requires local access and the ability to open an ATM socket and invoke LANE ioctl operations. An unprivileged local user with CAP_NET_ADMIN or on a system that exposes ATM socket creation to unprivileged callers can trigger the race by repeatedly invoking ioctl handlers that reach lecd_attach() and other LEC entry points. Successful exploitation of a use-after-free in kernel space can lead to arbitrary kernel memory corruption and local privilege escalation. See the upstream patch commit for the code-level fix.

// See upstream patches referenced below - no synthetic PoC provided
// Vulnerable path (conceptual):
//   lecd_attach() -> alloc_netdev_mqs() -> dev_lec[i] = dev
//   (error) -> free_netdev(dev)          // dev_lec[i] still points to freed memory
//   lane_ioctl() -> reads dev_lec[i]     // use-after-free

Detection Methods for CVE-2025-38323

Indicators of Compromise

KASAN reports referencing lecd_attach, lane_ioctl, or net/atm/lec.c in kernel logs.
Unexpected kernel oops, panic, or general protection fault originating from ATM socket ioctl paths.
Presence of unprivileged processes opening AF_ATMPVC or AF_ATMSVC sockets on systems where ATM is not operationally required.

Detection Strategies

Enable KASAN in test and staging kernels to catch slab-use-after-free events in the LEC code path.
Audit auditd for socket() calls with the ATM address families and correlate with subsequent ioctl activity.
Monitor kernel ring buffer (dmesg) for stack traces containing lecd_attach, lec_vcc_attach, or lec_mcast_attach.

Monitoring Recommendations

Alert on kernel crashes and oops events forwarded from endpoint telemetry to central logging.
Baseline expected usage of the ATM subsystem across the fleet; any process invoking ATM ioctl on general-purpose hosts warrants investigation.
Track kernel package versions across the estate to confirm patch coverage against advisory commits.

How to Mitigate CVE-2025-38323

Immediate Actions Required

Apply the vendor-supplied kernel updates from your Linux distribution, including the fixes referenced in the Debian LTS Announcement 2025-10 msg00007 and Debian LTS Announcement 2025-10 msg00008.
Where the ATM subsystem is not required, blacklist ATM kernel modules to remove the attack surface entirely.
Restrict local shell access on multi-tenant systems until patches are deployed.

Patch Information

The upstream fix adds a lec_mutex to serialize access to dev_lec[] across lecd_attach(), lec_vcc_attach(), and lec_mcast_attach(). Backports have been merged across stable branches. Reference commits: 17e156a, 18e8f0c, 64b378d, a7a713d, d13a382, dffd034, e91274c, f4d80b1.

Workarounds

Blacklist the lec, atm, and related ATM modules via /etc/modprobe.d/ to prevent load at boot.
Deny unprivileged creation of ATM sockets using seccomp policies or LSM rules (AppArmor, SELinux) that restrict AF_ATMPVC and AF_ATMSVC.
Limit CAP_NET_ADMIN assignment to workloads that explicitly require it.

bash

# Blacklist ATM modules to remove the vulnerable code path
cat <<'EOF' | sudo tee /etc/modprobe.d/blacklist-atm.conf
blacklist atm
blacklist lec
blacklist br2684
blacklist clip
EOF

sudo depmod -a
sudo update-initramfs -u

# Verify modules are not loaded
lsmod | grep -E 'atm|lec'