CVE-2025-38251 Details
Description
In the Linux kernel, the following vulnerability has been resolved: atm: clip: prevent NULL deref in clip_push() Blamed commit missed that vcc_destroy_socket() calls clip_push() with a NULL skb. If clip_devs is NULL, clip_push() then crashes when reading skb->truesize.
A vulnerability in the Linux kernel's ATM CLIP component can lead to a NULL pointer dereference. The issue arises in the 'clip_push()' function, which can crash the kernel if 'clip_devs' is NULL. This vulnerability was introduced because 'vcc_destroy_socket()' calls 'clip_push()' with a NULL socket buffer, allowing the function to attempt to read a NULL reference, causing a crash.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/3c709dce16999bf6a1d2ce377deb5dd6fdd8cb08 | kernel.org | Patch |
| https://git.kernel.org/stable/c/41f6420ee845006354c004839fed07da71e34aee | kernel.org | Patch |
| https://git.kernel.org/stable/c/88c88f91f4b3563956bb52e7a71a3640f7ece157 | kernel.org | Patch |
| https://git.kernel.org/stable/c/9199e8cb75f13a1650adcb3c6cad42789c43884e | kernel.org | Patch |
| https://git.kernel.org/stable/c/a07005a77b18ae59b8471e7e4d991fa9f642b3c2 | kernel.org | Patch |
| https://git.kernel.org/stable/c/b993ea46b3b601915ceaaf3c802adf11e7d6bac6 | kernel.org | Patch |
| https://git.kernel.org/stable/c/ede31ad949ae0d03cb4c5edd79991586ad7c8bb8 | kernel.org | Patch |
| https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html | CVE | Mailing ListThird Party Advisory |
| https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html | CVE | Mailing ListThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 5.7.1, < 5.10.240 >= 5.11, < 5.15.187 >= 5.16, < 6.1.143 >= 6.2, < 6.6.96 >= 6.7, < 6.12.36 >= 6.13, < 6.15.5 5.7 - 5.7 rc5 5.7 rc6 5.7 rc7 6.16 rc1 6.16 rc2 6.16 rc3 |
CPE
Remediation
| |
| debian debian linux | 11.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Dec 18, 2025 | Initial Analysis | [email protected] |
| Nov 3, 2025 | CVE Modified | CVE |
| Jul 17, 2025 | CVE Modified | kernel.org |
| Jul 10, 2025 | CVE Modified | kernel.org |
| Jul 9, 2025 | New CVE Received | kernel.org |