# CVE-2025-38245: atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister().

Status: published. Published: 2025-07-09. Updated: 2026-11-05.

In the Linux kernel, the following vulnerability has been resolved:

atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister().

syzbot reported a warning below during atm_dev_register(). [0]

Before creating a new device and procfs/sysfs for it, atm_dev_register()
looks up a duplicated device by __atm_dev_lookup().  These operations are
done under atm_dev_mutex.

However, when removing a device in atm_dev_deregister(), it releases the
mutex just after removing the device from the list that __atm_dev_lookup()
iterates over.

So, there will be a small race window where the device does not exist on
the device list but procfs/sysfs are still not removed, triggering the
splat.

Let's hold the mutex until procfs/sysfs are removed in
atm_dev_deregister().

[0]:
proc_dir_entry 'atm/atmtcp:0' already registered
WARNING: CPU: 0 PID: 5919 at fs/proc/generic.c:377 proc_register+0x455/0x5f0 fs/proc/generic.c:377
Modules linked in:
CPU: 0 UID: 0 PID: 5919 Comm: syz-executor284 Not tainted 6.16.0-rc2-syzkaller-00047-g52da431bf03b #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:proc_register+0x455/0x5f0 fs/proc/generic.c:377
Code: 48 89 f9 48 c1 e9 03 80 3c 01 00 0f 85 a2 01 00 00 48 8b 44 24 10 48 c7 c7 20 c0 c2 8b 48 8b b0 d8 00 00 00 e8 0c 02 1c ff 90 <0f> 0b 90 90 48 c7 c7 80 f2 82 8e e8 0b de 23 09 48 8b 4c 24 28 48
RSP: 0018:ffffc9000466fa30 EFLAGS: 00010282
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff817ae248
RDX: ffff888026280000 RSI: ffffffff817ae255 RDI: 0000000000000001
RBP: ffff8880232bed48 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: ffff888076ed2140
R13: dffffc0000000000 R14: ffff888078a61340 R15: ffffed100edda444
FS:  00007f38b3b0c6c0(0000) GS:ffff888124753000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f38b3bdf953 CR3: 0000000076d58000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 proc_create_data+0xbe/0x110 fs/proc/generic.c:585
 atm_proc_dev_register+0x112/0x1e0 net/atm/proc.c:361
 atm_dev_register+0x46d/0x890 net/atm/resources.c:113
 atmtcp_create+0x77/0x210 drivers/atm/atmtcp.c:369
 atmtcp_attach drivers/atm/atmtcp.c:403 [inline]
 atmtcp_ioctl+0x2f9/0xd60 drivers/atm/atmtcp.c:464
 do_vcc_ioctl+0x12c/0x930 net/atm/ioctl.c:159
 sock_do_ioctl+0x115/0x280 net/socket.c:1190
 sock_ioctl+0x227/0x6b0 net/socket.c:1311
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:907 [inline]
 __se_sys_ioctl fs/ioctl.c:893 [inline]
 __x64_sys_ioctl+0x18b/0x210 fs/ioctl.c:893
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f38b3b74459
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f38b3b0c198 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f38b3bfe318 RCX: 00007f38b3b74459
RDX: 0000000000000000 RSI: 0000000000006180 RDI: 0000000000000005
RBP: 00007f38b3bfe310 R08: 65732f636f72702f R09: 65732f636f72702f
R10: 65732f636f72702f R11: 0000000000000246 R12: 00007f38b3bcb0ac
R13: 00007f38b3b0c1a0 R14: 0000200000000200 R15: 00007f38b3bcb03b
 </TASK>

## Remediation

No remediation reported in collected sources

## Affected products and versions

- Linux / Linux: ≥ 64bf69ddff7637b7ed7acf9b2a823cc0ee519439; < 2a8dcee649d12f69713f2589171a1caf6d4fa439 (affected, git); ≥ 64bf69ddff7637b7ed7acf9b2a823cc0ee519439; < 4bb1bb438134d9ee6b97cc07289dd7c569092eec (affected, git); ≥ 64bf69ddff7637b7ed7acf9b2a823cc0ee519439; < 26248d5d68c865b888d632162abbf8130645622c (affected, git); ≥ 64bf69ddff7637b7ed7acf9b2a823cc0ee519439; < b2e40fcfe1575faaa548f87614006d3fe44c779e (affected, git); ≥ 64bf69ddff7637b7ed7acf9b2a823cc0ee519439; < cabed6ba92a9a8c09da02a3f20e32ecd80989896 (affected, git); ≥ 64bf69ddff7637b7ed7acf9b2a823cc0ee519439; < ae539d963a17443ec54cba8a767e4ffa318264f4 (affected, git); ≥ 64bf69ddff7637b7ed7acf9b2a823cc0ee519439; < 6922f1a048c090f10704bbef4a3a1e81932d2e0a (affected, git); ≥ 64bf69ddff7637b7ed7acf9b2a823cc0ee519439; < a433791aeaea6e84df709e0b9584b9bbe040cd1c (affected, git). Source: CNA: Linux
- Linux / Linux: 2.6.15 (affected); ≥ 0; < 2.6.15 (unaffected, semver); ≥ 5.4.296; ≤ 5.4.* (unaffected, semver); ≥ 5.10.240; ≤ 5.10.* (unaffected, semver); ≥ 5.15.187; ≤ 5.15.* (unaffected, semver); ≥ 6.1.143; ≤ 6.1.* (unaffected, semver); ≥ 6.6.96; ≤ 6.6.* (unaffected, semver); ≥ 6.12.36; ≤ 6.12.* (unaffected, semver); ≥ 6.15.5; ≤ 6.15.* (unaffected, semver); ≥ 6.16; ≤ * (unaffected, original_commit_for_fix). Source: CNA: Linux

## Severity and prioritization

- CISA KEV: No listing in collected sources

- EPSS: 0.19% as of 2026-11-05; percentile 8.65%

- SSVC: exploitation none; automatable no; technical impact partial; source ADP: CISA-ADP

- Weaknesses: Not reported

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://git.kernel.org/stable/c/2a8dcee649d12f69713f2589171a1caf6d4fa439 (CNA: Linux)

- https://git.kernel.org/stable/c/4bb1bb438134d9ee6b97cc07289dd7c569092eec (CNA: Linux)

- https://git.kernel.org/stable/c/26248d5d68c865b888d632162abbf8130645622c (CNA: Linux)

- https://git.kernel.org/stable/c/b2e40fcfe1575faaa548f87614006d3fe44c779e (CNA: Linux)

- https://git.kernel.org/stable/c/cabed6ba92a9a8c09da02a3f20e32ecd80989896 (CNA: Linux)

- https://git.kernel.org/stable/c/ae539d963a17443ec54cba8a767e4ffa318264f4 (CNA: Linux)

- https://git.kernel.org/stable/c/6922f1a048c090f10704bbef4a3a1e81932d2e0a (CNA: Linux)

- https://git.kernel.org/stable/c/a433791aeaea6e84df709e0b9584b9bbe040cd1c (CNA: Linux)

- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html (ADP: CVE)

- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html (ADP: CVE)

## Provenance

- CNA: Linux: https://www.cve.org/CVERecord?id=CVE-2025-38245; retrieved 2026-11-05; source updated 2026-11-05

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2025-38245; retrieved 2026-11-05; source updated Not reported

Revision: 162bca16721e72cafae5a5d0b033389c0791ddf53ee8ea2b7fdad1a9f5ed5c30

Canonical: https://y2.dev/cve/CVE-2025-38245

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.