Skip to main content

Linux Kernel CVE-2025-22004

HIGH
Use After Free (CWE-416)
2025-04-03 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Denial Of Service Linux Use After Free Memory Corruption
8.6
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
8.6 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
vuln.today AI
4.7 MEDIUM

ATM LEC access is local and config-dependent (AV:L, PR:L); UAF timing makes it AC:H; a memory-corruption bug in a legacy path realistically yields a kernel crash (A:H) with no clear info disclosure (C:N/I:N).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
High

Lifecycle Timeline

7
Analysis Updated
Jul 30, 2026 - 09:22 vuln.today
v3 (cvss_changed)
Analysis Updated
Jul 30, 2026 - 09:20 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 30, 2026 - 06:37 vuln.today
cvss_changed
CVSS changed
Jul 30, 2026 - 06:37 NVD
7.8 (HIGH) 8.6 (HIGH)
Analysis Generated
Mar 28, 2026 - 18:34 vuln.today
Patch released
Mar 28, 2026 - 18:34 nvd
Patch available
CVE Published
Apr 03, 2025 - 08:15 nvd
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net: atm: fix use after free in lec_send()

The ->send() operation frees skb so save the length before calling ->send() to avoid a use after free.

AnalysisAI

Denial-of-service via a use-after-free in the Linux kernel's ATM LAN Emulation (LANE) driver allows an attacker with access to an ATM LEC interface to corrupt kernel memory. The flaw lives in lec_send(), where the ->send() operation frees the skb but the code subsequently reads the skb length, dereferencing freed memory. Affected pre-release kernels include 6.14-rc1 through 6.14-rc4 and backport-affected stable branches; a fix is available, EPSS probability is very low (0.05%), there is no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

The vulnerability is in the ATM (Asynchronous Transfer Mode) LAN Emulation subsystem (net/atm/lec.c), a legacy networking stack that emulates Ethernet over ATM virtual circuits. In lec_send(), the driver invokes the virtual circuit's ->send() callback to transmit an sk_buff; per the kernel's skb ownership contract, ->send() consumes and frees the buffer. The bug is a classic CWE-416 use-after-free: the original code referenced skb->len (for statistics accounting) after ->send() had already freed the skb. The fix saves the length in a local variable before calling ->send(). The CPE data scopes this to cpe:2.3:o:linux:linux_kernel, explicitly flagging the 6.14 rc1-rc4 development cycle, though stable-tree backports mean multiple maintained branches were patched.

RemediationAI

Apply the vendor kernel update: the upstream fix is available as stable-tree commits at git.kernel.org (e.g., 326223182e4703cde99fdbd36d07d0b3de9980fb, 51e8be9578a2e74f9983d8fd8de8cafed191f30c, 9566f6ee13b17a15d0a47667ad1b1893c539f730, f3009d0d6ab78053117f8857b921a8237f4d17b3, f3271f7548385e0096739965961c7cbf7e6b4762), which move the skb length read before the ->send() call. Enterprise users should install the fixed packages from their distribution: Red Hat via RHSA-2025:11375 / 11358 / 11299 / 11298 / 12623 (access.redhat.com/errata) and Debian per the debian-lts-announce May 2025 advisories. Exact upstream tagged release versions were not provided in the input, so confirm the fixed version against your distribution's advisory before deployment. As a compensating control where patching is delayed, unload or blacklist the ATM LANE module (rmmod lec / blacklist in modprobe.d) and disable ATM networking if not required - this eliminates the attack surface entirely with no impact on systems that do not use ATM, which is the overwhelming majority.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Liberty Linux 8 Fixed
SUSE Liberty Linux 9 Fixed
SUSE Linux Enterprise Desktop 15 SP6 SUSE Linux Enterprise Server 15 SP6 SUSE Linux Enterprise Server for SAP Applications 15 SP6 SUSE Linux Enterprise Workstation Extension 15 SP6 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed

Share

CVE-2025-22004 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy