High

CVE-2025-39828 — atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control().

In the Linux kernel, the following vulnerability has been resolved: atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). syzbot reported the splat below. [0] When atmtcp_v_open() or atmtcp_v_close() is called via connect() or close(), atmtcp_send_control() is called to send an in-kernel special message. The message has ATMTCP_HDR_MAGIC in atmtcp_control.hdr.length. Also, a pointer of struct atm_vcc is set to atmtcp_control.vcc. The notable thing is struct atmtcp_control is uAPI but has a space for an in-kernel pointer. struct atmtcp_control { struct atmtcp_hdr hdr; /* must be first */ ... atm_kptr_t vcc; /* both directions */ ... } __ATM_API_ALIGN; typedef struct { unsigned char _[8]; } __ATM_API_ALIGN atm_kptr_t; The special message is processed in atmtcp_recv_control() called from atmtcp_c_send(). atmtcp_c_send() is vcc->dev->ops->send() and called from 2 paths: 1. .ndo_start_xmit() (vcc->send() == atm_send_aal0()) 2. vcc_sendmsg() The problem is sendmsg() does not validate the message length and userspace can abuse atmtcp_recv_control() to overwrite any kptr by atmtcp_control. Let's add a new ->pre_send() hook to validate messages from sendmsg(). [0]: Oops: general protection fault, probably for non-canonical address 0xdffffc00200000ab: 0000 [#1] SMP KASAN PTI KASAN: probably user-memory-access in range [0x0000000100000558-0x000000010000055f] CPU: 0 UID: 0 PID: 5865 Comm: syz-executor331 Not tainted 6.17.0-rc1-syzkaller-00215-gbab3ce404553 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:atmtcp_recv_control drivers/atm/atmtcp.c:93 [inline] RIP: 0010:atmtcp_c_send+0x1da/0x950 drivers/atm/atmtcp.c:297 Code: 4d 8d 75 1a 4c 89 f0 48 c1 e8 03 42 0f b6 04 20 84 c0 0f 85 15 06 00 00 41 0f b7 1e 4d 8d b7 60 05 00 00 4c 89 f0 48 c1 e8 03 <42> 0f b6 04 20 84 c0 0f 85 13 06 00 00 66 41 89 1e 4d 8d 75 1c 4c RSP: 0018:ffffc90003f5f810 EFLAGS: 00010203 RAX: 00000000200000ab RBX: 0000000000000000 RCX: 0000000000000000 RDX: ffff88802a510000 RSI: 00000000ffffffff RDI: ffff888030a6068c RBP: ffff88802699fb40 R08: ffff888030a606eb R09: 1ffff1100614c0dd R10: dffffc0000000000 R11: ffffffff8718fc40 R12: dffffc0000000000 R13: ffff888030a60680 R14: 000000010000055f R15: 00000000ffffffff FS: 00007f8d7e9236c0(0000) GS:ffff888125c1c000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000045ad50 CR3: 0000000075bde000 CR4: 00000000003526f0 Call Trace: <TASK> vcc_sendmsg+0xa10/0xc60 net/atm/common.c:645 sock_sendmsg_nosec net/socket.c:714 [inline] __sock_sendmsg+0x219/0x270 net/socket.c:729 ____sys_sendmsg+0x505/0x830 net/socket.c:2614 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2668 __sys_sendmsg net/socket.c:2700 [inline] __do_sys_sendmsg net/socket.c:2705 [inline] __se_sys_sendmsg net/socket.c:2703 [inline] __x64_sys_sendmsg+0x19b/0x260 net/socket.c:2703 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f8d7e96a4a9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f8d7e923198 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f8d7e9f4308 RCX: 00007f8d7e96a4a9 RDX: 0000000000000000 RSI: 0000200000000240 RDI: 0000000000000005 RBP: 00007f8d7e9f4300 R08: 65732f636f72702f R09: 65732f636f72702f R10: 65732f636f72702f R11: 0000000000000246 R12: 00007f8d7e9c10ac R13: 00007f8d7e9231a0 R14: 0000200000000200 R15: 0000200000000250 </TASK> Modules linked in:

Published Sep 16, 2025 · Updated Oct 19, 2026 · Sources: NIST National Vulnerability Database, CVE Program (cve.org) e CISA ADP, GitHub Security Advisories · CNA: Linux

Low

Who exploits it and how urgent it is

A 0–100 score combining confirmed exploitation, ransomware and APT use, public exploits, EPSS and severity.

No exploitation signal in the sources consulted so far.

How the score was calculated

EPSS 0.2% (30-day exploitation probability)+1
Technical severity (high)+6

The score orders the patch queue; it does not replace your asset context (internet exposure, criticality, compensating controls).

Triage

Is it exploited, how likely is exploitation, what does it touch, and how severe do the sources call it.

Exploitation

Not confirmed

Not in CISA KEV — an absence of record, not proof it is unexploited.

EPSS FIRST

0.17%

ahead of 6% of scored CVEs · Oct 19, 2026

Affects

Debian

Debian Linux and 2 more

CVSS base

7.8

High · 2 source(s)

Remediation

Fixes and mitigations documented by the sources — linked to the original advisory.

Documented patch — git.kernel.org (NIST National Vulnerability Database)
Documented patch — git.kernel.org (NIST National Vulnerability Database)
Documented patch — git.kernel.org (NIST National Vulnerability Database)
Documented patch — git.kernel.org (NIST National Vulnerability Database)
Documented patch — git.kernel.org (NIST National Vulnerability Database)
Documented patch — git.kernel.org (NIST National Vulnerability Database)
Documented patch — git.kernel.org (NIST National Vulnerability Database)
Documented patch — git.kernel.org (NIST National Vulnerability Database)

First 24 hours

Ordered from the record’s own fields — exposure first, because you cannot patch what you have not found. A rule-generated starting point.

Identify exposed assets running the affected vendor/product/version combinations (Debian Debian Linux, Linux Linux, Linux Linux Kernel).
Apply the fixed version or the patch documented under Remediation.
Search available logs for exploit probes, errors and authentication anomalies.

Affected scope

Vendor, product and versions as the sources word them.

Vendor	Product	Versions	Status	Source
Debian	Debian Linux	version 11.0	Vulnerable	NIST National Vulnerability Database
Linux	Linux	version 2.6.12≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and < ec79003c5f9d2c7f9576fc69b8dbda80305cbe3a≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and < 3ab9f5ad9baefe6d3d4c37053cdfca2761001dfe≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and < 33f9e6dc66b32202b95fc861e6b3ea4b0c185b0b≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and < 3c80c230d6e3e6f63d43f4c3f0bb344e3e8b119b≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and < 51872b26429077be611b0a1816e0e722278015c3≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and < 62f368472b0aa4b5d91d9b983152855c6b6d8925≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and < 0a6a6d4fb333f7afe22e59ffed18511a7a98efc8 and 1 more ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and < b502f16bad8f0a4cfbd023452766f21bfda39dde	Vulnerable	CVE Program (cve.org) e CISA ADP
Linux	Linux Kernel	version 2.6.12-rc5version 6.17-rc3version 6.17-rc2version 6.17-rc1version 2.6.12-rc4version 2.6.12-rc3version 2.6.12-rc2version 2.6.12 and 7 more ≥ 6.13 and < 6.16.5≥ 6.7 and < 6.12.45≥ 6.2 and < 6.6.104≥ 5.16 and < 6.1.150≥ 5.11 and < 5.15.191≥ 5.5 and < 5.10.242≥ 2.6.12.1 and < 5.4.298	Vulnerable	NIST National Vulnerability Database

Attack characteristics

The CVSS vector, decoded. It describes the attack, not your exposure to it.

Attack vector

Local

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Every base score collected

Sources score independently and may disagree; each row says who scored it and under which version.

Score	Version	Severity	Expl.	Impact	Scored by
7.8	CVSS 3.1	High	1.8	5.9	nvd@nist.gov via NIST National Vulnerability Database
7.8	CVSS 3.1	High	—	—	GitHub, Inc. via GitHub Security Advisories

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (score shown at the top: nvd@nist.gov)

Detection

Read off the CVSS vector and the weakness class. Starting points, not tested rules.

Local/physical vector: focus on endpoint telemetry (EDR) from affected hosts.

endpoint telemetry (EDR)

Timeline

What happened to this CVE, newest first.

2026
Affected products added · linux/linux
Oct 19, 2026 · CVE Program (cve.org) e CISA ADP
Record published
Oct 19, 2026
Fix documented
Oct 19, 2026 · NIST National Vulnerability Database
Affected products added · linux/linux kernel, debian/debian linux
Oct 19, 2026 · NIST National Vulnerability Database
CVSS changed · 7.8
Oct 19, 2026 · NIST National Vulnerability Database
Source status changed · → Modified
Oct 19, 2026 · NIST National Vulnerability Database
Record created in this database
Oct 19, 2026 · Alertas do Telegram
2025
CVE published
Sep 16, 2025 · Linux

Source activity

Repeated readings are counted rather than listed.

2× References added · Oct 19, 2026 – Oct 19, 2026
1× Official description updated · Oct 19, 2026 – Oct 19, 2026

References

13 on the record

git.kernel.org/stable/c/3ab9f5ad9baefe6d3d4c37053cdfca2761001dfe
Patch, NIST National Vulnerability Database
git.kernel.org/stable/c/0a6a6d4fb333f7afe22e59ffed18511a7a98efc8
Patch, NIST National Vulnerability Database
git.kernel.org/stable/c/ec79003c5f9d2c7f9576fc69b8dbda80305cbe3a
Patch, NIST National Vulnerability Database
git.kernel.org/stable/c/b502f16bad8f0a4cfbd023452766f21bfda39dde
Patch, NIST National Vulnerability Database
git.kernel.org/stable/c/51872b26429077be611b0a1816e0e722278015c3
Patch, NIST National Vulnerability Database
git.kernel.org/stable/c/3c80c230d6e3e6f63d43f4c3f0bb344e3e8b119b
Patch, NIST National Vulnerability Database
git.kernel.org/stable/c/33f9e6dc66b32202b95fc861e6b3ea4b0c185b0b
Patch, NIST National Vulnerability Database
git.kernel.org/stable/c/62f368472b0aa4b5d91d9b983152855c6b6d8925
Patch, NIST National Vulnerability Database
nvd.nist.gov/vuln/detail/CVE-2025-39828
GitHub Security Advisories
github.com/advisories/GHSA-2v5c-9mj7-vp9g
GitHub Security Advisories
cert-portal.siemens.com/productcert/html/ssa-032379.html
NIST National Vulnerability Database
lists.debian.org/debian-lts-announce/2025/10/msg00007.html
Mailing List, Third Party Advisory, NIST National Vulnerability Database
lists.debian.org/debian-lts-announce/2025/10/msg00008.html
Mailing List, Third Party Advisory, NIST National Vulnerability Database

Elsewhere on this site

Debian
every CVE for this vendor

Related CVEs (same products)

Unknown CVE-2026-98866 sched/cache: Introduce task_struct->sched_cache_grp to fix UAF 1d
Unknown CVE-2026-98867 dm-pcache: bound the logical key offset from persistent memory 1d
Unknown CVE-2026-98868 dm-pcache: reject a kset that overruns its segment 1d
Unknown CVE-2026-98856 kprobes: Skip disarmed probes when checking optkprobe overlap 1d
Unknown CVE-2026-98857 ipvs: bound LBLCR and LBLC cache growth 1d
Unknown CVE-2026-98858 io_uring: fix task_work add use-after-free with SQPOLL 1d

Not in any source we poll

Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.

No CISA SSVC assessment.
No CWE classification.
No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
No exploit packet captures, log samples, or incident case IDs supplied.

Answered from this record

Text assembled only from the fields above — no additional claims.

What should defenders know first?

CVE-2025-39828 is "atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control().", rated High. It affects Debian Linux (Debian); versions are in the scope table. It is not in CISA KEV, which does not rule out exploitation. CVSS 7.8 describes technical severity. EPSS 0.17% estimates the probability of exploitation in 30 days; neither replaces your asset context. First verify whether exposed or business-critical assets run the affected versions, apply vendor fixes or mitigations, and preserve logs for review.

Comments

Moderated technical discussion. Read the community guidelines.

No comments yet.