CVE-2025-38245: atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister().
atm: Release atmdevmutex after removing procfs in atmdevderegister().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
In atm_dev_deregister(), hold atm_dev_mutex until the device's procfs/sysfs entries have been removed, then release the mutex; do not release it immediately after removing the device from the list.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38245?
CVE-2025-38245 has a medium severity rating due to its potential impact on system stability and device operation.
How do I fix CVE-2025-38245?
To fix CVE-2025-38245, update to the latest version of the Linux kernel that includes the patch for this vulnerability.
What systems are affected by CVE-2025-38245?
CVE-2025-38245 affects the Linux kernel, specifically instances where the ATM subsystem is utilized.
What is the nature of CVE-2025-38245 vulnerability?
CVE-2025-38245 is related to improper mutex handling during the deregistration of ATM devices in the Linux kernel.
When was CVE-2025-38245 reported?
CVE-2025-38245 was reported as a warning during the operation of atm_dev_register(), highlighting an issue in the Linux kernel.