In the Linux kernel, the following vulnerability has been resolved:
atm: clip: Fix memory leak of struct clip_vcc.
ioctl(ATMARPMKIP) allocates struct clipvcc and set it to vcc->user_back.
The code assumes that vccdestroysocket() passes NULL skb to vcc->push() when the socket is close()d, and then clippush() frees clipvcc.
However, ioctl(ATMARPDCTRL) sets NULL to vcc->push() in atminit_atmarp(), resulting in memory leak.
Let's serialise two ioctl() by locksock() and check vcc->push() in atminit_atmarp() to prevent memleak.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c17ff462d98c997d707ee5cf4e4a9b1b52b9d90",
"target": {
"file": "net/atm/clip.c",
"function": "atm_init_atmarp"
},
"id": "CVE-2025-38546-2e964943",
"signature_type": "Function",
"digest": {
"function_hash": "121739817266769151327297189308003072764",
"length": 511.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c17ff462d98c997d707ee5cf4e4a9b1b52b9d90",
"target": {
"file": "net/atm/clip.c",
"function": "clip_ioctl"
},
"id": "CVE-2025-38546-8db19065",
"signature_type": "Function",
"digest": {
"function_hash": "127299291173998514629684295488319140838",
"length": 766.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1c075e88d5859a2c6b43b27e0e46fb281cef8039",
"target": {
"file": "net/atm/clip.c"
},
"id": "CVE-2025-38546-976daebe",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"315549152173859537858969232855590588219",
"69957319739987523103900388710200508342",
"322375212986737818154443346685749877718",
"38274068973864169891200118683536363075",
"3538384888415475944508637690251192746",
"155883975710497918075114199331086080690",
"226548360768416143032036880685140076218",
"95120378623222396912063625089681738691",
"291824799044801963510119389365704934940",
"50950085962139646019276833734616577890",
"97374071211484672294949730690526014401",
"215392293134497733039597835954899497078",
"192813796275781035456423188595069954099",
"316768771679787647169332365340176565963",
"309883551458841701841416739683084766975",
"325847352192048028318292889207145414980",
"21417445553227406518535636918787581441",
"96121727732759359106079355067918964295",
"210132223777405900355644215356683340320",
"218608725313461883481232114731542268919"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1c075e88d5859a2c6b43b27e0e46fb281cef8039",
"target": {
"file": "net/atm/clip.c",
"function": "atm_init_atmarp"
},
"id": "CVE-2025-38546-9b481316",
"signature_type": "Function",
"digest": {
"function_hash": "121739817266769151327297189308003072764",
"length": 511.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c17ff462d98c997d707ee5cf4e4a9b1b52b9d90",
"target": {
"file": "net/atm/clip.c"
},
"id": "CVE-2025-38546-bf27026d",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"315549152173859537858969232855590588219",
"69957319739987523103900388710200508342",
"322375212986737818154443346685749877718",
"38274068973864169891200118683536363075",
"3538384888415475944508637690251192746",
"155883975710497918075114199331086080690",
"226548360768416143032036880685140076218",
"95120378623222396912063625089681738691",
"291824799044801963510119389365704934940",
"50950085962139646019276833734616577890",
"97374071211484672294949730690526014401",
"215392293134497733039597835954899497078",
"192813796275781035456423188595069954099",
"316768771679787647169332365340176565963",
"309883551458841701841416739683084766975",
"325847352192048028318292889207145414980",
"21417445553227406518535636918787581441",
"96121727732759359106079355067918964295",
"210132223777405900355644215356683340320",
"218608725313461883481232114731542268919"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1c075e88d5859a2c6b43b27e0e46fb281cef8039",
"target": {
"file": "net/atm/clip.c",
"function": "clip_ioctl"
},
"id": "CVE-2025-38546-da8be934",
"signature_type": "Function",
"digest": {
"function_hash": "127299291173998514629684295488319140838",
"length": 766.0
},
"deprecated": false,
"signature_version": "v1"
}
]