CVE-2025-39828

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control().

syzbot reported the splat below. [0]

When atmtcp_v_open() or atmtcp_v_close() is called via connect()

or close(), atmtcp_send_control() is called to send an in-kernel

special message.

The message has ATMTCP_HDR_MAGIC in atmtcp_control.hdr.length.

Also, a pointer of struct atm_vcc is set to atmtcp_control.vcc.

The notable thing is struct atmtcp_control is uAPI but has a

space for an in-kernel pointer.

struct atmtcp_control {

struct atmtcp_hdr hdr; /* must be first */

...

atm_kptr_t vcc; /* both directions */

...

} __ATM_API_ALIGN;

typedef struct { unsigned char _[8]; } __ATM_API_ALIGN atm_kptr_t;

The special message is processed in atmtcp_recv_control() called

from atmtcp_c_send().

atmtcp_c_send() is vcc->dev->ops->send() and called from 2 paths:

1. .ndo_start_xmit() (vcc->send() == atm_send_aal0())

2. vcc_sendmsg()

The proble

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References