CVE-2025-38245

CVE-2025-38245 describes a race condition in the Linux kernel's ATM subsystem, specifically affecting the atm_dev_deregister() function. This vulnerability impacts various Linux distributions, including Debian and Ubuntu, where the kernel versions are susceptible. The vulnerability has a CVSS score of 7.8 (High), indicating a local attack vector with low complexity and potential for high impact on confidentiality, integrity, and availability. The issue arises because the atm_dev_mutex is released prematurely, creating a window where procfs/sysfs entries for a device might still exist after the device itself is removed from the list, leading to a warning and potential system instability. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Despite this, the vulnerability has garnered significant community discussion and media coverage, suggesting a high level of awareness and concern within the cybersecurity community.