In the Linux kernel, the following vulnerability has been resolved:
net: atm: add lec_mutex
syzbot found its way in net/atm/lec.c, and found an error path in lecdattach() could leave a dangling pointer in devlec[].
Add a mutex to protect devlecp[] uses from lecdattach(), lecvccattach() and lecmcastattach().
Following patch will use this mutex for /proc/net/atm/lec.
BUG: KASAN: slab-use-after-free in lecdattach net/atm/lec.c:751 [inline] BUG: KASAN: slab-use-after-free in laneioctl+0x2224/0x23e0 net/atm/lec.c:1008 Read of size 8 at addr ffff88807c7b8e68 by task syz.1.17/6142
CPU: 1 UID: 0 PID: 6142 Comm: syz.1.17 Not tainted 6.16.0-rc1-syzkaller-00239-g08215f5486ec #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Call Trace: <TASK> _dumpstack lib/dumpstack.c:94 [inline] dumpstacklvl+0x116/0x1f0 lib/dumpstack.c:120 printaddressdescription mm/kasan/report.c:408 [inline] printreport+0xcd/0x680 mm/kasan/report.c:521 kasanreport+0xe0/0x110 mm/kasan/report.c:634 lecdattach net/atm/lec.c:751 [inline] laneioctl+0x2224/0x23e0 net/atm/lec.c:1008 dovccioctl+0x12c/0x930 net/atm/ioctl.c:159 sockdoioctl+0x118/0x280 net/socket.c:1190 sockioctl+0x227/0x6b0 net/socket.c:1311 vfsioctl fs/ioctl.c:51 [inline] _dosysioctl fs/ioctl.c:907 [inline] _sesysioctl fs/ioctl.c:893 [inline] _x64sysioctl+0x18e/0x210 fs/ioctl.c:893 dosyscallx64 arch/x86/entry/syscall64.c:63 [inline] dosyscall64+0xcd/0x4c0 arch/x86/entry/syscall64.c:94 entrySYSCALL64after_hwframe+0x77/0x7f </TASK>
Allocated by task 6132: kasansavestack+0x33/0x60 mm/kasan/common.c:47 kasansavetrack+0x14/0x30 mm/kasan/common.c:68 poisonkmallocredzone mm/kasan/common.c:377 [inline] _kasankmalloc+0xaa/0xb0 mm/kasan/common.c:394 kasankmalloc include/linux/kasan.h:260 [inline] _dokmallocnode mm/slub.c:4328 [inline] _kvmallocnodenoprof+0x27b/0x620 mm/slub.c:5015 allocnetdevmqs+0xd2/0x1570 net/core/dev.c:11711 lecdattach net/atm/lec.c:737 [inline] laneioctl+0x17db/0x23e0 net/atm/lec.c:1008 dovccioctl+0x12c/0x930 net/atm/ioctl.c:159 sockdoioctl+0x118/0x280 net/socket.c:1190 sockioctl+0x227/0x6b0 net/socket.c:1311 vfsioctl fs/ioctl.c:51 [inline] _dosysioctl fs/ioctl.c:907 [inline] _sesysioctl fs/ioctl.c:893 [inline] _x64sysioctl+0x18e/0x210 fs/ioctl.c:893 dosyscallx64 arch/x86/entry/syscall64.c:63 [inline] dosyscall64+0xcd/0x4c0 arch/x86/entry/syscall64.c:94 entrySYSCALL64afterhwframe+0x77/0x7f
Freed by task 6132: kasansavestack+0x33/0x60 mm/kasan/common.c:47 kasansavetrack+0x14/0x30 mm/kasan/common.c:68 kasansavefreeinfo+0x3b/0x60 mm/kasan/generic.c:576 poisonslabobject mm/kasan/common.c:247 [inline] _kasanslabfree+0x51/0x70 mm/kasan/common.c:264 kasanslabfree include/linux/kasan.h:233 [inline] slabfreehook mm/slub.c:2381 [inline] slabfree mm/slub.c:4643 [inline] kfree+0x2b4/0x4d0 mm/slub.c:4842 freenetdev+0x6c5/0x910 net/core/dev.c:11892 lecdattach net/atm/lec.c:744 [inline] laneioctl+0x1ce8/0x23e0 net/atm/lec.c:1008 dovccioctl+0x12c/0x930 net/atm/ioctl.c:159 sockdoioctl+0x118/0x280 net/socket.c:1190 sockioctl+0x227/0x6b0 net/socket.c:1311 vfsioctl fs/ioctl.c:51 [inline] _dosysioctl fs/ioctl.c:907 [inline] _sesysioctl fs/ioctl.c:893 [inline] _x64sys_ioctl+0x18e/0x210 fs/ioctl.c:893
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@18e8f0c4f826fb08c2d3825cdd6c57e24b207e0a",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "69595873672979035987903329049169423131",
"length": 772.0
},
"target": {
"function": "lec_vcc_attach",
"file": "net/atm/lec.c"
},
"id": "CVE-2025-38323-168a8d4c"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d13a3824bfd2b4774b671a75cf766a16637a0e67",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "121456746214515181974752779249692989210",
"length": 608.0
},
"target": {
"function": "lane_ioctl",
"file": "net/atm/lec.c"
},
"id": "CVE-2025-38323-1aea289a"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@18e8f0c4f826fb08c2d3825cdd6c57e24b207e0a",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "340172887722517170518000211227036394146",
"length": 307.0
},
"target": {
"function": "lec_mcast_attach",
"file": "net/atm/lec.c"
},
"id": "CVE-2025-38323-26d8dfd4"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d13a3824bfd2b4774b671a75cf766a16637a0e67",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "65408294520130821354869959598194885499",
"length": 1468.0
},
"target": {
"function": "lecd_attach",
"file": "net/atm/lec.c"
},
"id": "CVE-2025-38323-27879b42"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@18e8f0c4f826fb08c2d3825cdd6c57e24b207e0a",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "65408294520130821354869959598194885499",
"length": 1468.0
},
"target": {
"function": "lecd_attach",
"file": "net/atm/lec.c"
},
"id": "CVE-2025-38323-488453b4"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@18e8f0c4f826fb08c2d3825cdd6c57e24b207e0a",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"9272415096474248376496179064977589728",
"67767513902074893244684430902696360240",
"91623953741443921379261781251063456906",
"274047100411167028985833380329196772729",
"279077260088995453082295311262669766060",
"67942955327987144921427836443484120359",
"215525913074572301867687004805727859191",
"133193365624888053809281941299568100249",
"241206959033771113634775388307742400738",
"272496242053402674301673864138375616699",
"311202839682162651145362974693421632443",
"195715775969452732774717136882727076991",
"41780878301983503951551564561576545078",
"268927175471391893177284759042494741682",
"178509207355737372784395500266971682758",
"918538980178562484614424760487076581",
"173386358157031510793360132917910452407",
"42599802489180885016687711323287968349",
"270247393270839863900704663906552505606",
"180284571297523586917411906191578123813",
"169252998412986424901226081704647638266",
"226155606766295540086759271177565595465",
"289714871080233351738684029762829160247",
"26198187629805000304602540504309626873"
]
},
"target": {
"file": "net/atm/lec.c"
},
"id": "CVE-2025-38323-626cdfe8"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@18e8f0c4f826fb08c2d3825cdd6c57e24b207e0a",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "121456746214515181974752779249692989210",
"length": 608.0
},
"target": {
"function": "lane_ioctl",
"file": "net/atm/lec.c"
},
"id": "CVE-2025-38323-695c1cf8"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f4d80b16ecc4229f7e6345158ef34c36be323f0e",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "340172887722517170518000211227036394146",
"length": 307.0
},
"target": {
"function": "lec_mcast_attach",
"file": "net/atm/lec.c"
},
"id": "CVE-2025-38323-6cec3976"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d13a3824bfd2b4774b671a75cf766a16637a0e67",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"9272415096474248376496179064977589728",
"67767513902074893244684430902696360240",
"91623953741443921379261781251063456906",
"274047100411167028985833380329196772729",
"279077260088995453082295311262669766060",
"67942955327987144921427836443484120359",
"215525913074572301867687004805727859191",
"133193365624888053809281941299568100249",
"241206959033771113634775388307742400738",
"272496242053402674301673864138375616699",
"311202839682162651145362974693421632443",
"195715775969452732774717136882727076991",
"41780878301983503951551564561576545078",
"268927175471391893177284759042494741682",
"178509207355737372784395500266971682758",
"918538980178562484614424760487076581",
"173386358157031510793360132917910452407",
"42599802489180885016687711323287968349",
"270247393270839863900704663906552505606",
"180284571297523586917411906191578123813",
"169252998412986424901226081704647638266",
"226155606766295540086759271177565595465",
"289714871080233351738684029762829160247",
"26198187629805000304602540504309626873"
]
},
"target": {
"file": "net/atm/lec.c"
},
"id": "CVE-2025-38323-7aa628d8"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d13a3824bfd2b4774b671a75cf766a16637a0e67",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "340172887722517170518000211227036394146",
"length": 307.0
},
"target": {
"function": "lec_mcast_attach",
"file": "net/atm/lec.c"
},
"id": "CVE-2025-38323-8d1b899c"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f4d80b16ecc4229f7e6345158ef34c36be323f0e",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"9272415096474248376496179064977589728",
"67767513902074893244684430902696360240",
"91623953741443921379261781251063456906",
"274047100411167028985833380329196772729",
"279077260088995453082295311262669766060",
"67942955327987144921427836443484120359",
"215525913074572301867687004805727859191",
"133193365624888053809281941299568100249",
"241206959033771113634775388307742400738",
"272496242053402674301673864138375616699",
"311202839682162651145362974693421632443",
"195715775969452732774717136882727076991",
"41780878301983503951551564561576545078",
"268927175471391893177284759042494741682",
"178509207355737372784395500266971682758",
"918538980178562484614424760487076581",
"173386358157031510793360132917910452407",
"42599802489180885016687711323287968349",
"270247393270839863900704663906552505606",
"180284571297523586917411906191578123813",
"169252998412986424901226081704647638266",
"226155606766295540086759271177565595465",
"289714871080233351738684029762829160247",
"26198187629805000304602540504309626873"
]
},
"target": {
"file": "net/atm/lec.c"
},
"id": "CVE-2025-38323-a3deb399"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d13a3824bfd2b4774b671a75cf766a16637a0e67",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "69595873672979035987903329049169423131",
"length": 772.0
},
"target": {
"function": "lec_vcc_attach",
"file": "net/atm/lec.c"
},
"id": "CVE-2025-38323-dcaec647"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f4d80b16ecc4229f7e6345158ef34c36be323f0e",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "69595873672979035987903329049169423131",
"length": 772.0
},
"target": {
"function": "lec_vcc_attach",
"file": "net/atm/lec.c"
},
"id": "CVE-2025-38323-e5985326"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f4d80b16ecc4229f7e6345158ef34c36be323f0e",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "65408294520130821354869959598194885499",
"length": 1468.0
},
"target": {
"function": "lecd_attach",
"file": "net/atm/lec.c"
},
"id": "CVE-2025-38323-fa0f4b14"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f4d80b16ecc4229f7e6345158ef34c36be323f0e",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "121456746214515181974752779249692989210",
"length": 608.0
},
"target": {
"function": "lane_ioctl",
"file": "net/atm/lec.c"
},
"id": "CVE-2025-38323-ff89e825"
}
]