In the Linux kernel, the following vulnerability has been resolved:
atm: clip: Fix potential null-ptr-deref in to_atmarpd().
atmarpd is protected by RTNL since commit f3a0592b37b8 ("[ATM]: clip causes unregister hang").
However, it is not enough because toatmarpd() is called without RTNL, especially clipneighsolicit() / neighops->solicit() is unsleepable.
Also, there is no RTNL dependency around atmarpd.
Let's use a private mutex and RCU to protect access to atmarpd in to_atmarpd().
[
    {
        "signature_version": "v1",
        "id": "CVE-2025-38460-0c5ac5ca",
        "signature_type": "Function",
        "digest": {
            "length": 219.0,
            "function_hash": "215196272898039839096754973418505855858"
        },
        "target": {
            "file": "net/atm/clip.c",
            "function": "atmarpd_close"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f58e4270c73e7f086322978d585ea67c8076ce49",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-38460-1b0877ae",
        "signature_type": "Function",
        "digest": {
            "length": 219.0,
            "function_hash": "215196272898039839096754973418505855858"
        },
        "target": {
            "file": "net/atm/clip.c",
            "function": "atmarpd_close"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ee4d9e4ddf3f9c4ee2ec0a3aad6196ee36d30e57",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-38460-30c2fb91",
        "signature_type": "Function",
        "digest": {
            "length": 453.0,
            "function_hash": "217250682411336415677684725903988705486"
        },
        "target": {
            "file": "net/atm/clip.c",
            "function": "atm_init_atmarp"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@06935c50cfa3ac57cce80bba67b6d38ec1406e92",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-38460-3261ace4",
        "signature_type": "Function",
        "digest": {
            "length": 453.0,
            "function_hash": "217250682411336415677684725903988705486"
        },
        "target": {
            "file": "net/atm/clip.c",
            "function": "atm_init_atmarp"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@36caab990b69ef4eec1d81c52a19f080b7daa059",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-38460-43a82cb3",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "224320433466992794863718270105432805957",
                "213494850023566945068774956805698277016",
                "105097806412803416296599158901670105657",
                "75737341815098507518766067068063813100",
                "95547983701180288177338183589683594852",
                "74635319795613279913129967597459305856",
                "181055113323506307492055406456647532732",
                "303361649227236010082246471233081181151",
                "103859888537917369248703678156774162515",
                "201774968142374933644068884479666134397",
                "94042783882971520583099156944994937563",
                "158762253956700694763566641776039919465",
                "36199604587741468303520696578383391249",
                "314145990733792588015890847717146119889",
                "322792952368209793586850942431614229843",
                "146613220139145606928210066246598749121",
                "127705893829296536904186567639834096501",
                "100571784937681033956597142037174959559",
                "96913991139579661194247519199187811959",
                "127340741367428123128601316887420811408",
                "252534589193184533719046076064707056626",
                "171886152902217965559373939954952011408",
                "73629502192911491992556996954388660312",
                "172418202064112224291977340347408203975",
                "292805741796718265590763153463174822575",
                "76568824190986135682021931021227413403",
                "136610209595871841740608549906201199882",
                "336101773694162250431800165807467545391",
                "321579171222193684129835881696400008762",
                "113755776160618764622572764112005359279",
                "202038996364752387023371214812052358670",
                "259745106251178405056894939712082446076",
                "292296604707782425849432282784362119552",
                "114087421326117471881608976027915133670",
                "66008160107887560566527738052779726209",
                "106430990010658991590358529233520792792",
                "281185795211084436461056462839423270690",
                "220346421914781305383195456302971235066",
                "175961122588886373350256594329474879606",
                "70885231239882227513705840922318940762",
                "203118250110436701144681549871196976811",
                "317243646115497660499209232567553735074",
                "132522238963723818746527512662400835460",
                "27068143129743799455969216054859354821",
                "145259706669195927504587780274224652910"
            ]
        },
        "target": {
            "file": "net/atm/clip.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f58e4270c73e7f086322978d585ea67c8076ce49",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-38460-47b5a6bc",
        "signature_type": "Function",
        "digest": {
            "length": 535.0,
            "function_hash": "336958457781671554490617744193582328859"
        },
        "target": {
            "file": "net/atm/clip.c",
            "function": "to_atmarpd"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ee4d9e4ddf3f9c4ee2ec0a3aad6196ee36d30e57",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-38460-47c6b485",
        "signature_type": "Function",
        "digest": {
            "length": 535.0,
            "function_hash": "336958457781671554490617744193582328859"
        },
        "target": {
            "file": "net/atm/clip.c",
            "function": "to_atmarpd"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@70eac9ba7ce25d99c1d99bbf4ddb058940f631f9",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-38460-4f19eecf",
        "signature_type": "Function",
        "digest": {
            "length": 219.0,
            "function_hash": "215196272898039839096754973418505855858"
        },
        "target": {
            "file": "net/atm/clip.c",
            "function": "atmarpd_close"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@06935c50cfa3ac57cce80bba67b6d38ec1406e92",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-38460-516c6144",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "224320433466992794863718270105432805957",
                "213494850023566945068774956805698277016",
                "105097806412803416296599158901670105657",
                "75737341815098507518766067068063813100",
                "95547983701180288177338183589683594852",
                "74635319795613279913129967597459305856",
                "181055113323506307492055406456647532732",
                "303361649227236010082246471233081181151",
                "103859888537917369248703678156774162515",
                "201774968142374933644068884479666134397",
                "94042783882971520583099156944994937563",
                "158762253956700694763566641776039919465",
                "36199604587741468303520696578383391249",
                "314145990733792588015890847717146119889",
                "322792952368209793586850942431614229843",
                "146613220139145606928210066246598749121",
                "127705893829296536904186567639834096501",
                "100571784937681033956597142037174959559",
                "96913991139579661194247519199187811959",
                "127340741367428123128601316887420811408",
                "252534589193184533719046076064707056626",
                "171886152902217965559373939954952011408",
                "73629502192911491992556996954388660312",
                "172418202064112224291977340347408203975",
                "292805741796718265590763153463174822575",
                "76568824190986135682021931021227413403",
                "136610209595871841740608549906201199882",
                "336101773694162250431800165807467545391",
                "321579171222193684129835881696400008762",
                "113755776160618764622572764112005359279",
                "202038996364752387023371214812052358670",
                "259745106251178405056894939712082446076",
                "292296604707782425849432282784362119552",
                "114087421326117471881608976027915133670",
                "66008160107887560566527738052779726209",
                "106430990010658991590358529233520792792",
                "281185795211084436461056462839423270690",
                "220346421914781305383195456302971235066",
                "175961122588886373350256594329474879606",
                "70885231239882227513705840922318940762",
                "203118250110436701144681549871196976811",
                "317243646115497660499209232567553735074",
                "132522238963723818746527512662400835460",
                "27068143129743799455969216054859354821",
                "145259706669195927504587780274224652910"
            ]
        },
        "target": {
            "file": "net/atm/clip.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@36caab990b69ef4eec1d81c52a19f080b7daa059",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-38460-672e2bd9",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "224320433466992794863718270105432805957",
                "213494850023566945068774956805698277016",
                "105097806412803416296599158901670105657",
                "75737341815098507518766067068063813100",
                "95547983701180288177338183589683594852",
                "74635319795613279913129967597459305856",
                "181055113323506307492055406456647532732",
                "303361649227236010082246471233081181151",
                "103859888537917369248703678156774162515",
                "201774968142374933644068884479666134397",
                "94042783882971520583099156944994937563",
                "158762253956700694763566641776039919465",
                "36199604587741468303520696578383391249",
                "314145990733792588015890847717146119889",
                "322792952368209793586850942431614229843",
                "146613220139145606928210066246598749121",
                "127705893829296536904186567639834096501",
                "100571784937681033956597142037174959559",
                "96913991139579661194247519199187811959",
                "127340741367428123128601316887420811408",
                "252534589193184533719046076064707056626",
                "171886152902217965559373939954952011408",
                "73629502192911491992556996954388660312",
                "172418202064112224291977340347408203975",
                "292805741796718265590763153463174822575",
                "76568824190986135682021931021227413403",
                "136610209595871841740608549906201199882",
                "336101773694162250431800165807467545391",
                "321579171222193684129835881696400008762",
                "113755776160618764622572764112005359279",
                "202038996364752387023371214812052358670",
                "259745106251178405056894939712082446076",
                "292296604707782425849432282784362119552",
                "114087421326117471881608976027915133670",
                "66008160107887560566527738052779726209",
                "106430990010658991590358529233520792792",
                "281185795211084436461056462839423270690",
                "220346421914781305383195456302971235066",
                "175961122588886373350256594329474879606",
                "70885231239882227513705840922318940762",
                "203118250110436701144681549871196976811",
                "317243646115497660499209232567553735074",
                "132522238963723818746527512662400835460",
                "27068143129743799455969216054859354821",
                "145259706669195927504587780274224652910"
            ]
        },
        "target": {
            "file": "net/atm/clip.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@70eac9ba7ce25d99c1d99bbf4ddb058940f631f9",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-38460-6a9d13a7",
        "signature_type": "Function",
        "digest": {
            "length": 453.0,
            "function_hash": "217250682411336415677684725903988705486"
        },
        "target": {
            "file": "net/atm/clip.c",
            "function": "atm_init_atmarp"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@70eac9ba7ce25d99c1d99bbf4ddb058940f631f9",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-38460-74254010",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "224320433466992794863718270105432805957",
                "213494850023566945068774956805698277016",
                "105097806412803416296599158901670105657",
                "75737341815098507518766067068063813100",
                "95547983701180288177338183589683594852",
                "74635319795613279913129967597459305856",
                "181055113323506307492055406456647532732",
                "303361649227236010082246471233081181151",
                "103859888537917369248703678156774162515",
                "201774968142374933644068884479666134397",
                "94042783882971520583099156944994937563",
                "158762253956700694763566641776039919465",
                "36199604587741468303520696578383391249",
                "314145990733792588015890847717146119889",
                "322792952368209793586850942431614229843",
                "146613220139145606928210066246598749121",
                "127705893829296536904186567639834096501",
                "100571784937681033956597142037174959559",
                "96913991139579661194247519199187811959",
                "127340741367428123128601316887420811408",
                "252534589193184533719046076064707056626",
                "171886152902217965559373939954952011408",
                "73629502192911491992556996954388660312",
                "172418202064112224291977340347408203975",
                "292805741796718265590763153463174822575",
                "76568824190986135682021931021227413403",
                "136610209595871841740608549906201199882",
                "336101773694162250431800165807467545391",
                "321579171222193684129835881696400008762",
                "113755776160618764622572764112005359279",
                "202038996364752387023371214812052358670",
                "259745106251178405056894939712082446076",
                "292296604707782425849432282784362119552",
                "114087421326117471881608976027915133670",
                "66008160107887560566527738052779726209",
                "106430990010658991590358529233520792792",
                "281185795211084436461056462839423270690",
                "220346421914781305383195456302971235066",
                "175961122588886373350256594329474879606",
                "70885231239882227513705840922318940762",
                "203118250110436701144681549871196976811",
                "317243646115497660499209232567553735074",
                "132522238963723818746527512662400835460",
                "27068143129743799455969216054859354821",
                "145259706669195927504587780274224652910"
            ]
        },
        "target": {
            "file": "net/atm/clip.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@06935c50cfa3ac57cce80bba67b6d38ec1406e92",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-38460-7ee1c814",
        "signature_type": "Function",
        "digest": {
            "length": 453.0,
            "function_hash": "217250682411336415677684725903988705486"
        },
        "target": {
            "file": "net/atm/clip.c",
            "function": "atm_init_atmarp"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ee4d9e4ddf3f9c4ee2ec0a3aad6196ee36d30e57",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-38460-8aa705cd",
        "signature_type": "Function",
        "digest": {
            "length": 535.0,
            "function_hash": "336958457781671554490617744193582328859"
        },
        "target": {
            "file": "net/atm/clip.c",
            "function": "to_atmarpd"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@06935c50cfa3ac57cce80bba67b6d38ec1406e92",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-38460-8fdbcad3",
        "signature_type": "Function",
        "digest": {
            "length": 219.0,
            "function_hash": "215196272898039839096754973418505855858"
        },
        "target": {
            "file": "net/atm/clip.c",
            "function": "atmarpd_close"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@70eac9ba7ce25d99c1d99bbf4ddb058940f631f9",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-38460-aa0b1900",
        "signature_type": "Function",
        "digest": {
            "length": 535.0,
            "function_hash": "336958457781671554490617744193582328859"
        },
        "target": {
            "file": "net/atm/clip.c",
            "function": "to_atmarpd"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@36caab990b69ef4eec1d81c52a19f080b7daa059",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-38460-c9f2147a",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "224320433466992794863718270105432805957",
                "213494850023566945068774956805698277016",
                "105097806412803416296599158901670105657",
                "75737341815098507518766067068063813100",
                "95547983701180288177338183589683594852",
                "74635319795613279913129967597459305856",
                "181055113323506307492055406456647532732",
                "303361649227236010082246471233081181151",
                "103859888537917369248703678156774162515",
                "201774968142374933644068884479666134397",
                "94042783882971520583099156944994937563",
                "158762253956700694763566641776039919465",
                "36199604587741468303520696578383391249",
                "314145990733792588015890847717146119889",
                "322792952368209793586850942431614229843",
                "146613220139145606928210066246598749121",
                "127705893829296536904186567639834096501",
                "100571784937681033956597142037174959559",
                "96913991139579661194247519199187811959",
                "127340741367428123128601316887420811408",
                "252534589193184533719046076064707056626",
                "171886152902217965559373939954952011408",
                "73629502192911491992556996954388660312",
                "172418202064112224291977340347408203975",
                "292805741796718265590763153463174822575",
                "76568824190986135682021931021227413403",
                "136610209595871841740608549906201199882",
                "336101773694162250431800165807467545391",
                "321579171222193684129835881696400008762",
                "113755776160618764622572764112005359279",
                "202038996364752387023371214812052358670",
                "259745106251178405056894939712082446076",
                "292296604707782425849432282784362119552",
                "114087421326117471881608976027915133670",
                "66008160107887560566527738052779726209",
                "106430990010658991590358529233520792792",
                "281185795211084436461056462839423270690",
                "220346421914781305383195456302971235066",
                "175961122588886373350256594329474879606",
                "70885231239882227513705840922318940762",
                "203118250110436701144681549871196976811",
                "317243646115497660499209232567553735074",
                "132522238963723818746527512662400835460",
                "27068143129743799455969216054859354821",
                "145259706669195927504587780274224652910"
            ]
        },
        "target": {
            "file": "net/atm/clip.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ee4d9e4ddf3f9c4ee2ec0a3aad6196ee36d30e57",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-38460-d7f21083",
        "signature_type": "Function",
        "digest": {
            "length": 535.0,
            "function_hash": "336958457781671554490617744193582328859"
        },
        "target": {
            "file": "net/atm/clip.c",
            "function": "to_atmarpd"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f58e4270c73e7f086322978d585ea67c8076ce49",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-38460-dfff3b2b",
        "signature_type": "Function",
        "digest": {
            "length": 219.0,
            "function_hash": "215196272898039839096754973418505855858"
        },
        "target": {
            "file": "net/atm/clip.c",
            "function": "atmarpd_close"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@36caab990b69ef4eec1d81c52a19f080b7daa059",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-38460-e8c65ed2",
        "signature_type": "Function",
        "digest": {
            "length": 453.0,
            "function_hash": "217250682411336415677684725903988705486"
        },
        "target": {
            "file": "net/atm/clip.c",
            "function": "atm_init_atmarp"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f58e4270c73e7f086322978d585ea67c8076ce49",
        "deprecated": false
    }
]