CVE-2025-38546: linux kernel +1 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2025-38546

CVSS 5.5 · Medium EPSS 0,16%

Kerentanan Missing Release of Memory after Effective Lifetime pada linux kernel, debian linux. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

In the Linux kernel, the following vulnerability has been resolved: atm: clip: Fix memory leak of struct clip_vcc. ioctl(ATMARP_MKIP) allocates struct clip_vcc and set it to vcc->user_back. The code assumes that vcc_destroy_socket() passes NULL skb to vcc->push() when the socket is close()d, and then clip_push() frees clip_vcc. However, ioctl(ATMARPD_CTRL) sets NULL to vcc->push() in atm_init_atmarp(), resulting in memory leak. Let's serialise two ioctl() by lock_sock() and check vcc->push() in atm_init_atmarp() to prevent memleak.

Rincian

Terbit di NVD: 16 Agustus 2025
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-401: Missing Release of Memory after Effective Lifetime
EPSS (30 hari): 0,16% peluang dieksploitasi; lebih tinggi dari 5,0% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
linux	linux kernel	Versi 2.6.13 hingga sebelum 5.4.296
linux	linux kernel	Versi 5.5 hingga sebelum 5.10.240
linux	linux kernel	Versi 5.11 hingga sebelum 5.15.189
linux	linux kernel	Versi 5.16 hingga sebelum 6.1.146
linux	linux kernel	Versi 6.2 hingga sebelum 6.6.99
linux	linux kernel	Versi 6.7 hingga sebelum 6.12.39
linux	linux kernel	Versi 6.13 hingga sebelum 6.15.7
linux	linux kernel	Versi 2.6.12
linux	linux kernel	Versi 2.6.12 rc2
linux	linux kernel	Versi 2.6.12 rc3
linux	linux kernel	Versi 2.6.12 rc4
linux	linux kernel	Versi 2.6.12 rc5
linux	linux kernel	Versi 6.16 rc1
linux	linux kernel	Versi 6.16 rc2
linux	linux kernel	Versi 6.16 rc3
linux	linux kernel	Versi 6.16 rc4
linux	linux kernel	Versi 6.16 rc5
debian	debian linux	Versi 11.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://git.kernel.org/stable/c/0c17ff462d98c997d707ee5cf4e4a9b1b52b9d90 patch
https://git.kernel.org/stable/c/1c075e88d5859a2c6b43b27e0e46fb281cef8039 patch
https://git.kernel.org/stable/c/1fb9fb5a4b5cec2d56e26525ef8c519de858fa60 patch
https://git.kernel.org/stable/c/2fb37ab3226606cbfc9b2b6f9e301b0b735734c5 patch
https://git.kernel.org/stable/c/62dba28275a9a3104d4e33595c7b3328d4032d8d patch
https://git.kernel.org/stable/c/9e4dbeee56f614e3f1e166e5d0655a999ea185ef patch
https://git.kernel.org/stable/c/9f771816f14da6d6157a8c30069091abf6b566fb patch
https://git.kernel.org/stable/c/cb2e4a2f8f268d8fba6662f663a2e57846f14a8d patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html mailing list · advisory pihak ketiga
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html mailing list · advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.