In the Linux kernel, the following vulnerability has been resolved:
atm: clip: Fix infinite recursive call of clip_push().
syzbot reported the splat below. [0]
This happens if we call ioctl(ATMARP_MKIP) more than once.
During the first call, clipmkip() sets clippush() to vcc->push(), and the second call copies it to clipvcc->oldpush().
Later, when the socket is close()d, vccdestroysocket() passes NULL skb to clippush(), which calls clipvcc->old_push(), triggering the infinite recursion.
Let's prevent the second ioctl(ATMARPMKIP) by checking vcc->userback, which is allocated by the first call as clip_vcc.
Note also that we use lock_sock() to prevent racy calls.
Oops: stack guard page: 0000 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 5322 Comm: syz.0.0 Not tainted 6.16.0-rc4-syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:clippush+0x5/0x720 net/atm/clip.c:191 Code: e0 8f aa 8c e8 1c ad 5b fa eb ae 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 55 <41> 57 41 56 41 55 41 54 53 48 83 ec 20 48 89 f3 49 89 fd 48 bd 00 RSP: 0018:ffffc9000d670000 EFLAGS: 00010246 RAX: 1ffff1100235a4a5 RBX: ffff888011ad2508 RCX: ffff8880003c0000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888037f01000 RBP: dffffc0000000000 R08: ffffffff8fa104f7 R09: 1ffffffff1f4209e R10: dffffc0000000000 R11: ffffffff8a99b300 R12: ffffffff8a99b300 R13: ffff888037f01000 R14: ffff888011ad2500 R15: ffff888037f01578 FS: 000055557ab6d500(0000) GS:ffff88808d250000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffc9000d66fff8 CR3: 0000000043172000 CR4: 0000000000352ef0 Call Trace: <TASK> clippush+0x6dc/0x720 net/atm/clip.c:200 clippush+0x6dc/0x720 net/atm/clip.c:200 clippush+0x6dc/0x720 net/atm/clip.c:200 ... clippush+0x6dc/0x720 net/atm/clip.c:200 clippush+0x6dc/0x720 net/atm/clip.c:200 clippush+0x6dc/0x720 net/atm/clip.c:200 vccdestroysocket net/atm/common.c:183 [inline] vccrelease+0x157/0x460 net/atm/common.c:205 _sockrelease net/socket.c:647 [inline] sockclose+0xc0/0x240 net/socket.c:1391 _fput+0x449/0xa70 fs/filetable.c:465 taskworkrun+0x1d1/0x260 kernel/taskwork.c:227 resumeusermodework include/linux/resumeusermode.h:50 [inline] exittousermodeloop+0xec/0x110 kernel/entry/common.c:114 exittousermodeprepare include/linux/entry-common.h:330 [inline] syscallexittousermodework include/linux/entry-common.h:414 [inline] syscallexittousermode include/linux/entry-common.h:449 [inline] dosyscall64+0x2bd/0x3b0 arch/x86/entry/syscall64.c:100 entrySYSCALL64afterhwframe+0x77/0x7f RIP: 0033:0x7ff31c98e929 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fffb5aa1f78 EFLAGS: 00000246 ORIGRAX: 00000000000001b4 RAX: 0000000000000000 RBX: 0000000000012747 RCX: 00007ff31c98e929 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00007ff31cbb7ba0 R08: 0000000000000001 R09: 0000000db5aa226f R10: 00007ff31c7ff030 R11: 0000000000000246 R12: 00007ff31cbb608c R13: 00007ff31cbb6080 R14: ffffffffffffffff R15: 00007fffb5aa2090 </TASK> Modules linked in:
[
{
"signature_version": "v1",
"id": "CVE-2025-38459-0b7fccb0",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"34233615133609193489601232842098419769",
"83313257126748190114170013595808470974",
"303261574779104450649892651632681180361",
"188808420876119980179975591060168738699"
]
},
"target": {
"file": "net/atm/clip.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5641019dfbaee5e85fe093b590f0451c9dd4d6f8",
"deprecated": false
},
{
"signature_version": "v1",
"id": "CVE-2025-38459-18059425",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"34233615133609193489601232842098419769",
"83313257126748190114170013595808470974",
"303261574779104450649892651632681180361",
"188808420876119980179975591060168738699"
]
},
"target": {
"file": "net/atm/clip.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3f61b997fe014bbfcc208a9fcbd363a1fe7e3a31",
"deprecated": false
},
{
"signature_version": "v1",
"id": "CVE-2025-38459-1f61b416",
"signature_type": "Function",
"digest": {
"length": 610.0,
"function_hash": "194269770505344493214570758657579647800"
},
"target": {
"file": "net/atm/clip.c",
"function": "clip_mkip"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f493f31a63847624fd3199ac836a8bd8828e50e2",
"deprecated": false
},
{
"signature_version": "v1",
"id": "CVE-2025-38459-1fb16d4f",
"signature_type": "Function",
"digest": {
"length": 610.0,
"function_hash": "194269770505344493214570758657579647800"
},
"target": {
"file": "net/atm/clip.c",
"function": "clip_mkip"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5641019dfbaee5e85fe093b590f0451c9dd4d6f8",
"deprecated": false
},
{
"signature_version": "v1",
"id": "CVE-2025-38459-2f602e28",
"signature_type": "Function",
"digest": {
"length": 610.0,
"function_hash": "194269770505344493214570758657579647800"
},
"target": {
"file": "net/atm/clip.c",
"function": "clip_mkip"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@024876b247a882972095b22087734dcd23396a4e",
"deprecated": false
},
{
"signature_version": "v1",
"id": "CVE-2025-38459-540d6b92",
"signature_type": "Function",
"digest": {
"length": 610.0,
"function_hash": "194269770505344493214570758657579647800"
},
"target": {
"file": "net/atm/clip.c",
"function": "clip_mkip"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1579a2777cb914a249de22c789ba4d41b154509f",
"deprecated": false
},
{
"signature_version": "v1",
"id": "CVE-2025-38459-61a7adce",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"34233615133609193489601232842098419769",
"83313257126748190114170013595808470974",
"303261574779104450649892651632681180361",
"188808420876119980179975591060168738699"
]
},
"target": {
"file": "net/atm/clip.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f493f31a63847624fd3199ac836a8bd8828e50e2",
"deprecated": false
},
{
"signature_version": "v1",
"id": "CVE-2025-38459-6e2cb732",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"34233615133609193489601232842098419769",
"83313257126748190114170013595808470974",
"303261574779104450649892651632681180361",
"188808420876119980179975591060168738699"
]
},
"target": {
"file": "net/atm/clip.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c489f3283dbfc0f3c00c312149cae90d27552c45",
"deprecated": false
},
{
"signature_version": "v1",
"id": "CVE-2025-38459-6fe68f72",
"signature_type": "Function",
"digest": {
"length": 610.0,
"function_hash": "194269770505344493214570758657579647800"
},
"target": {
"file": "net/atm/clip.c",
"function": "clip_mkip"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3f61b997fe014bbfcc208a9fcbd363a1fe7e3a31",
"deprecated": false
},
{
"signature_version": "v1",
"id": "CVE-2025-38459-77c80f79",
"signature_type": "Function",
"digest": {
"length": 610.0,
"function_hash": "194269770505344493214570758657579647800"
},
"target": {
"file": "net/atm/clip.c",
"function": "clip_mkip"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c489f3283dbfc0f3c00c312149cae90d27552c45",
"deprecated": false
},
{
"signature_version": "v1",
"id": "CVE-2025-38459-bc144905",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"34233615133609193489601232842098419769",
"83313257126748190114170013595808470974",
"303261574779104450649892651632681180361",
"188808420876119980179975591060168738699"
]
},
"target": {
"file": "net/atm/clip.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@024876b247a882972095b22087734dcd23396a4e",
"deprecated": false
},
{
"signature_version": "v1",
"id": "CVE-2025-38459-cb8ae30e",
"signature_type": "Function",
"digest": {
"length": 610.0,
"function_hash": "194269770505344493214570758657579647800"
},
"target": {
"file": "net/atm/clip.c",
"function": "clip_mkip"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@df0312d8859763aa15b8b56ac151a1ea4a4e5b88",
"deprecated": false
},
{
"signature_version": "v1",
"id": "CVE-2025-38459-e983c451",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"34233615133609193489601232842098419769",
"83313257126748190114170013595808470974",
"303261574779104450649892651632681180361",
"188808420876119980179975591060168738699"
]
},
"target": {
"file": "net/atm/clip.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@df0312d8859763aa15b8b56ac151a1ea4a4e5b88",
"deprecated": false
},
{
"signature_version": "v1",
"id": "CVE-2025-38459-f3bf34eb",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"34233615133609193489601232842098419769",
"83313257126748190114170013595808470974",
"303261574779104450649892651632681180361",
"188808420876119980179975591060168738699"
]
},
"target": {
"file": "net/atm/clip.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1579a2777cb914a249de22c789ba4d41b154509f",
"deprecated": false
}
]