Executive brief
A vulnerability in the Linux kernel's AppleTalk networking protocol could allow a local user to cause a system malfunction. The issue stems from a failure to properly manage internal references to network hardware when updating network routes. This can lead to resource exhaustion or system instability, potentially impacting the availability of the server or workstation.
Technical details
A reference count leak exists in net/appletalk/ddp.c within the atrtr_create() function. When updating an existing AppleTalk route entry, the code fails to call dev_put() on the old device reference before assigning a new device via dev_hold(). This results in a persistent increment of the device reference counter that is never decremented, preventing the network device from being properly unassigned or freed. An attacker with local access could potentially trigger this leak repeatedly to cause resource exhaustion or a denial of service. Patches have been released across multiple stable kernel branches (e.g., 4.19.y, 5.4.y, 5.10.y, 5.15.y, 6.1.y, 6.6.y).
Affected products
- Linux Linux Kernel 2.6.12 through 6.1.146
Timeline
- 2025-07-10: patched: Initial fix committed to mainline kernel
- 2025-08-16: disclosed: CVE-2025-38542 published
References
- https://git.kernel.org/stable/c/473f3eadfc73b0fb6d8dee5829d19a5772e387f7
- https://git.kernel.org/stable/c/4a17370da6e476d3d275534e9e9cd2d02c57ca46
- https://git.kernel.org/stable/c/64124cf0aab0dd1e18c0fb5ae66e45741e727f8b
- https://git.kernel.org/stable/c/711c80f7d8b163d3ecd463cd96f07230f488e750
- https://git.kernel.org/stable/c/a7852b01793669248dce0348d14df89e77a32afd
- https://git.kernel.org/stable/c/b2f5dfa87367fdce9f8b995bc6c38f64f9ea2c90
- https://git.kernel.org/stable/c/b92bedf71f25303e203a4e657489d76691a58119