CVE-2025-38323

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified)

Description: A use-after-free issue was identified in the net/atm/lec.c component of the Linux kernel. Specifically, an error path in the lecd attach() function could result in a dangling pointer within the dev lec[] array. A mutex was added to protect uses of dev lecp[] from lecd attach(), lec vcc attach(), and lec mcast attach(). This issue was discovered by syzbot during testing. The vulnerability manifests in the lane ioctl() function and can be triggered through the /proc/net/atm/lec interface.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.