CVE-2025-22004

net: atm: fix use after free in lec_send()

State: Published
Severity: 8.6 High
Published: Apr 3, 2025
Updated: Aug 5, 2026
Reserved: Dec 29, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

net: atm: fix use after free in lec_send()

The ->send() operation frees skb so save the length before calling ->send() to avoid a use after free.

Scores

CVSS	Score	Vector	Source
3.1	8.6 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H	Linux
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
LinuxLinux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 50e288097c2c6e5f374ae079394436fc29d1e88eAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 8cd90c7db08f32829bfa1b5b2b11fbc542afbab7Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 82d9084a97892de1ee4881eb5c17911fcd9be6f6Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 51e8be9578a2e74f9983d8fd8de8cafed191f30cAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 9566f6ee13b17a15d0a47667ad1b1893c539f730Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 326223182e4703cde99fdbd36d07d0b3de9980fbAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before f3271f7548385e0096739965961c7cbf7e6b4762Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before f3009d0d6ab78053117f8857b921a8237f4d17b3Affected
LinuxLinux	2.6.12Affected before 2.6.12Not affected 5.4.292 through 5.4.Not affected 5.10.236 through 5.10.Not affected 5.15.180 through 5.15.Not affected 6.1.132 through 6.1.Not affected 6.6.85 through 6.6.Not affected 6.12.21 through 6.12.Not affected 6.13.9 through 6.13.*Not affected 6.14 and laterNot affected

Product

Versions

LinuxLinux

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 50e288097c2c6e5f374ae079394436fc29d1e88eAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 8cd90c7db08f32829bfa1b5b2b11fbc542afbab7Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 82d9084a97892de1ee4881eb5c17911fcd9be6f6Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 51e8be9578a2e74f9983d8fd8de8cafed191f30cAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 9566f6ee13b17a15d0a47667ad1b1893c539f730Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 326223182e4703cde99fdbd36d07d0b3de9980fbAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before f3271f7548385e0096739965961c7cbf7e6b4762Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before f3009d0d6ab78053117f8857b921a8237f4d17b3Affected

LinuxLinux

2.6.12Affected
before 2.6.12Not affected
5.4.292 through 5.4.*Not affected
5.10.236 through 5.10.*Not affected
5.15.180 through 5.15.*Not affected
6.1.132 through 6.1.*Not affected
6.6.85 through 6.6.*Not affected
6.12.21 through 6.12.*Not affected
6.13.9 through 6.13.*Not affected
6.14 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.