Bug 2376376 (CVE-2025-38180)

Summary:	CVE-2025-38180 kernel: Linux kernel: Use-After-Free vulnerability in ATM subsystem
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Linux kernel's Asynchronous Transfer Mode (ATM) subsystem. An authenticated local attacker could exploit a Use-After-Free (UAF) vulnerability in the /proc/net/atm/lec handling. This flaw occurs due to improper dev_put() calls without prior dev_hold() calls, leading to an imbalance in reference counting. Successful exploitation could allow the attacker to achieve privilege escalation or cause a denial of service.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-07-04 14:02:22 UTC

In the Linux kernel, the following vulnerability has been resolved:

net: atm: fix /proc/net/atm/lec handling

/proc/net/atm/lec must ensure safety against dev_lec[] changes.

It appears it had dev_put() calls without prior dev_hold(),
leading to imbalance and UAF.

Comment 1 Mauro Matteo Cascella 2025-07-04 19:09:17 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025070410-CVE-2025-38180-c6d0@gregkh/T

Comment 4 errata-xmlrpc 2026-03-30 02:18:10 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:6036 https://access.redhat.com/errata/RHSA-2026:6036

Comment 5 errata-xmlrpc 2026-03-30 02:40:49 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:6037 https://access.redhat.com/errata/RHSA-2026:6037

Comment 6 errata-xmlrpc 2026-03-30 11:06:21 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:6153 https://access.redhat.com/errata/RHSA-2026:6153

Comment 7 errata-xmlrpc 2026-04-01 00:45:06 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2026:6310 https://access.redhat.com/errata/RHSA-2026:6310

Comment 8 errata-xmlrpc 2026-04-08 00:11:16 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:6948 https://access.redhat.com/errata/RHSA-2026:6948

Comment 9 errata-xmlrpc 2026-04-08 00:38:25 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:6940 https://access.redhat.com/errata/RHSA-2026:6940

Comment 10 errata-xmlrpc 2026-04-08 03:24:14 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Advanced Update Support

Via RHSA-2026:6953 https://access.redhat.com/errata/RHSA-2026:6953

Comment 11 errata-xmlrpc 2026-04-08 03:32:19 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:6954 https://access.redhat.com/errata/RHSA-2026:6954

Comment 12 errata-xmlrpc 2026-04-08 05:06:28 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.6 Telecommunications Update Service

Via RHSA-2026:6961 https://access.redhat.com/errata/RHSA-2026:6961

Comment 13 errata-xmlrpc 2026-04-08 05:58:16 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:6986 https://access.redhat.com/errata/RHSA-2026:6986

Comment 14 errata-xmlrpc 2026-04-08 08:32:08 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2026:7003 https://access.redhat.com/errata/RHSA-2026:7003

Comment 15 errata-xmlrpc 2026-04-08 12:10:59 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2026:7013 https://access.redhat.com/errata/RHSA-2026:7013

Comment 16 errata-xmlrpc 2026-04-08 15:42:31 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2026:7100 https://access.redhat.com/errata/RHSA-2026:7100