What’s Vulnerable › Vulnerabilities

CVE-2025-22004: net: atm: fix use after free in lec_send()

• Severity: high (CVSS 8.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-04-03 · updated 2026-07-30
• Weakness: CWE-416

Description

In the Linux kernel, the following vulnerability has been resolved: net: atm: fix use after free in lec_send() The ->send() operation frees skb so save the length before calling ->send() to avoid a use after free.

Affected products

• Linux kernel: from 2.6.12 before 6.1.132; from 6.2 before 6.6.85; from 6.7 before 6.12.21; from 6.13 before 6.13.9; 6.14-rc1, 6.14-rc2, 6.14-rc3, 6.14-rc4 — fixed in 6.1.132, 6.12.21, 6.13.9, 6.6.85

How to fix

Upgrade to a fixed version: Linux kernel 6.1.132, 6.12.21, 6.13.9, 6.6.85. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/326223182e4703cde99fdbd36d07d0b3de9980fb
• https://git.kernel.org/stable/c/50e288097c2c6e5f374ae079394436fc29d1e88e
• https://git.kernel.org/stable/c/51e8be9578a2e74f9983d8fd8de8cafed191f30c
• https://git.kernel.org/stable/c/82d9084a97892de1ee4881eb5c17911fcd9be6f6
• https://git.kernel.org/stable/c/8cd90c7db08f32829bfa1b5b2b11fbc542afbab7
• https://git.kernel.org/stable/c/9566f6ee13b17a15d0a47667ad1b1893c539f730
• https://git.kernel.org/stable/c/f3009d0d6ab78053117f8857b921a8237f4d17b3
• https://git.kernel.org/stable/c/f3271f7548385e0096739965961c7cbf7e6b4762
• https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html
• https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html

Get alerted when CVE-2025-22004 or the next vulnerability affects your stack