CVE-2025-38459: Linux Kernel Race Condition Vulnerability

CVE-2025-38459 Overview

CVE-2025-38459 is a Linux kernel vulnerability in the Asynchronous Transfer Mode (ATM) Classical IP over ATM (CLIP) subsystem. The flaw resides in net/atm/clip.c and causes uncontrolled recursion [CWE-674] in the clip_push() function. A local, unprivileged user can trigger the bug by invoking ioctl(ATMARP_MKIP) more than once on the same ATM socket, then closing the socket. The recursion exhausts the kernel stack and hits the stack guard page, producing a kernel oops and denial of service. The issue was discovered by the syzbot fuzzer and affects Linux kernel versions from 2.6.12 through 6.16-rc5, as well as Debian Linux 11.0.

Critical Impact
A local attacker can crash the kernel by triggering unbounded recursion in the ATM CLIP push handler, resulting in denial of service and potential impact to system confidentiality, integrity, and availability.

Affected Products

Linux Kernel versions 2.6.12 through 6.16-rc5
Debian Linux 11.0
Distributions shipping vulnerable kernels with the ATM CLIP module enabled

Discovery Timeline

Discovery - Reported by the syzbot kernel fuzzer
2025-07-25 - CVE-2025-38459 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-38459

Vulnerability Analysis

The vulnerability is an uncontrolled recursion flaw in the Linux kernel's ATM CLIP implementation. When user space issues the ATMARP_MKIP ioctl on an ATM Virtual Channel Connection (VCC), the kernel's clip_mkip() routine installs clip_push() as the VCC's packet receive handler by assigning it to vcc->push. On the first call, the previous push handler is preserved in clip_vcc->old_push so that clip_push() can chain to it when needed.

If the ioctl is invoked a second time on the same socket, clip_mkip() copies the now-installed clip_push() pointer into clip_vcc->old_push. Both vcc->push and clip_vcc->old_push then point to clip_push(). When the socket is closed, vcc_destroy_socket() calls clip_push() with a NULL skb, which by design invokes old_push, re-entering clip_push() indefinitely. The recursion consumes the kernel stack until it collides with the stack guard page, generating the reported oops at RIP: clip_push+0x5/0x720 net/atm/clip.c:191.

Root Cause

The root cause is missing state validation in clip_mkip(). The function does not check whether the ATM VCC has already been converted to a CLIP VCC before reassigning callback pointers. The fix introduces a check on vcc->user_back, which is allocated during the first successful conversion, and adds lock_sock() to serialize concurrent callers and eliminate the race window.

Attack Vector

Exploitation requires local access and the ability to open an ATM socket, which typically requires CAP_NET_ADMIN on standard configurations. An attacker opens an ATM socket, issues ioctl(ATMARP_MKIP) twice on the same file descriptor, then closes the socket. The close path triggers vcc_destroy_socket(), which invokes the self-referential push chain and crashes the kernel. No network reachability is required, and no user interaction is needed beyond executing the local process.

See the upstream fix in the kernel.org stable commit for the exact patch applied to net/atm/clip.c.

Detection Methods for CVE-2025-38459

Indicators of Compromise

Kernel oops messages referencing clip_push+ in the call trace with repeated identical frames at net/atm/clip.c:200.
BUG: TASK stack guard page was hit entries in dmesg or /var/log/kern.log originating from the ATM subsystem.
Unexpected process terminations of programs that opened PF_ATMPVC or PF_ATMSVC sockets, followed by kernel panic or soft lockup.

Detection Strategies

Audit for loaded kernel modules atm, clip, and mkiss on systems where ATM functionality is not required. Presence on modern servers is a strong candidate for module blacklisting.
Enable auditd rules on the ioctl syscall filtered for ATM socket file descriptors to identify repeated ATMARP_MKIP invocations from the same PID.
Monitor kernel ring buffer output for stack-guard-page violations and correlate the faulting instruction pointer to ATM subsystem symbols.

Monitoring Recommendations

Forward dmesg and /var/log/kern.log to a centralized logging or SIEM platform and alert on stack guard page and clip_push string matches.
Track kernel version inventory across the fleet and flag hosts still running kernels prior to the stable commits listed on kernel.org for this CVE.
Baseline which hosts legitimately require the ATM stack; investigate any new module loads of clip.ko outside that baseline.

How to Mitigate CVE-2025-38459

Immediate Actions Required

Apply the vendor-supplied kernel update from your Linux distribution as soon as it is available. Debian users should install updates referenced in the Debian LTS Announcement.
On systems that do not require ATM networking, blacklist the clip and atm kernel modules to eliminate the attack surface entirely.
Restrict CAP_NET_ADMIN and access to ATM socket families to trusted service accounts only.

Patch Information

The fix has been merged into mainline Linux and backported to multiple stable branches. Relevant commits include f493f31a6384, 024876b247a8, 125166347d56, 1579a2777cb9, 3f61b997fe01, 5641019dfbae, c489f3283dbf, and df0312d88597. Distribution package updates are available for Debian via the Debian LTS advisory. Verify the running kernel version after patching with uname -r and confirm it corresponds to a version containing the backport.

Workarounds

Unload and blacklist the clip module: prevents the vulnerable code path from being reachable on hosts that do not use Classical IP over ATM.
Remove or restrict access to the ATM device nodes and deny the PF_ATMPVC and PF_ATMSVC socket families through seccomp or LSM policy where feasible.
Deploy Linux Security Module (LSM) policies such as SELinux or AppArmor to confine processes that legitimately require ATM sockets, preventing untrusted binaries from invoking ATMARP_MKIP.

bash

# Blacklist the vulnerable ATM CLIP module
echo "blacklist clip" | sudo tee /etc/modprobe.d/blacklist-clip.conf
echo "blacklist atm"  | sudo tee -a /etc/modprobe.d/blacklist-clip.conf

# Unload the module if currently loaded
sudo modprobe -r clip 2>/dev/null || true

# Verify the module is not loaded
lsmod | grep -E '^(clip|atm)\b' && echo "ATM modules still present" || echo "ATM modules removed"

# Confirm the patched kernel is running
uname -r