5.5

CVE-2025-38251: debian debian_linux NULL Pointer Dereference

CVSS: 5.5v3.1MediumAnalyzed
AliasesUBUNTU-CVE-2025-38251DEBIAN-CVE-2025-38251
Published 09-07-2025Last modified 11-05-2026

Vulnerability summary

CVE-2025-38251 is a medium (CVSS 5.5) NULL Pointer Dereference vulnerability in debian debian_linux. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 6.9% of scored vulnerabilities.

Overall risk
22/100
0100
Low · default modelHow is this calculated?
CVSS score
5.5/10
010
Medium · v3.1 (NVD)
EPSS score
0.18%
0%100%
Low · +0.02 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 52 · Related 47

Timeline

  1. 09-07-2025
    PublishedVulnerability first disclosed.
  2. 11-05-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: atm: clip: prevent NULL deref in clip_push() Blamed commit missed that vcc_destroy_socket() calls clip_push() with a NULL skb. If clip_devs is NULL, clip_push() then crashes when reading skb->truesize.

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

0.18%

Chance of exploitation in the next 30 days

Percentile

7%

Versus all other CVEs

30-day change

+0.02 pp

From 0.16% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.18%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Ubuntu134 products
  • linux< 5.15.0-156.166 | < 6.8.0-100.100
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-aws< 5.15.0-1092.99 | < 6.8.0-1046.49
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian2 products
Linux2 products
  • linux≥ 93a2014afbace907178afc3c9c1e62c9a338595a, < 41f6420ee845006354c004839fed07da71e34aee | ≥ 93a2014afbace907178afc3c9c1e62c9a338595a, < 9199e8cb75f13a1650adcb3c6cad42789c43884e | ≥ 93a2014afbace907178afc3c9c1e62c9a338595a, < 88c88f91f4b3563956bb52e7a71a3640f7ece157 | ≥ 93a2014afbace907178afc3c9c1e62c9a338595a, < 3c709dce16999bf6a1d2ce377deb5dd6fdd8cb08 | ≥ 93a2014afbace907178afc3c9c1e62c9a338595a, < a07005a77b18ae59b8471e7e4d991fa9f642b3c2 | ≥ 93a2014afbace907178afc3c9c1e62c9a338595a, < ede31ad949ae0d03cb4c5edd79991586ad7c8bb8 | ≥ 93a2014afbace907178afc3c9c1e62c9a338595a, < b993ea46b3b601915ceaaf3c802adf11e7d6bac6 | 5.7
  • linux_kernel≥ 5.7.1, < 5.10.240 | ≥ 5.11, < 5.15.187 | ≥ 5.16, < 6.1.143 | ≥ 6.2, < 6.6.96 | ≥ 6.7, < 6.12.36 | ≥ 6.13, < 6.15.5 | 5.7 | 5.7:rc5 | 5.7:rc6 | 5.7:rc7 | 6.16:rc1 | 6.16:rc2 | 6.16:rc3

3 vendors · 138 products

References

45 links
Show all 45 references