CVE-2025-38542: net: appletalk: Fix device refcount leak in atrtr_create()
Vulnerability summary
CVE-2025-38542 is a high (CVSS 7.8) vulnerability in debian debian_linux. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 7.3% of scored vulnerabilities.
Not severe (CVSS 7.8, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 33 · Related 31Timeline
- 16-08-2025PublishedVulnerability first disclosed.
- 05-08-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: net: appletalk: Fix device refcount leak in atrtr_create() When updating an existing route entry in atrtr_create(), the old device reference was not being released before assigning the new device, leading to a device refcount leak. Fix this by calling dev_put() to release the old device reference before holding the new one.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HDiffers
- NVDNIST5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HDiffers
EPSS trend
Probability
0.18%
Chance of exploitation in the next 30 days
Percentile
7%
Versus all other CVEs
30-day change
Increase +0.01 pp
From 0.17% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu147 products
- linuxAll versions (No fix recorded) | < 5.15.0-156.166 | < 6.8.0-100.100
- linux-allwinner-5.19All versions (No fix recorded)
- linux-awsAll versions (No fix recorded) | < 5.15.0-1092.99 | < 6.8.0-1046.49
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Debian2 products
- linux< 6.1.147-1 | < 6.12.41-1 | < 6.16.3-1
- debian_linuxEOL11.0
Linux2 products
- linux≥ c7f905f0f6d49ed8c1aa4566c31f0383a0ba0c9d, < b92bedf71f25303e203a4e657489d76691a58119 | ≥ c7f905f0f6d49ed8c1aa4566c31f0383a0ba0c9d, < a7852b01793669248dce0348d14df89e77a32afd | ≥ c7f905f0f6d49ed8c1aa4566c31f0383a0ba0c9d, < b2f5dfa87367fdce9f8b995bc6c38f64f9ea2c90 | ≥ c7f905f0f6d49ed8c1aa4566c31f0383a0ba0c9d, < d2e9f50f0bdad73b64a871f25186b899624518c4 | ≥ c7f905f0f6d49ed8c1aa4566c31f0383a0ba0c9d, < 4a17370da6e476d3d275534e9e9cd2d02c57ca46 | ≥ c7f905f0f6d49ed8c1aa4566c31f0383a0ba0c9d, < 473f3eadfc73b0fb6d8dee5829d19a5772e387f7 | ≥ c7f905f0f6d49ed8c1aa4566c31f0383a0ba0c9d, < 64124cf0aab0dd1e18c0fb5ae66e45741e727f8b | ≥ c7f905f0f6d49ed8c1aa4566c31f0383a0ba0c9d, < 711c80f7d8b163d3ecd463cd96f07230f488e750 | 2.6.12
- linux_kernel≥ 2.6.13, < 5.4.296 | ≥ 5.5, < 5.10.240 | ≥ 5.11, < 5.15.189 | ≥ 5.16, < 6.1.146 | ≥ 6.2, < 6.6.99 | ≥ 6.7, < 6.12.39 | ≥ 6.13, < 6.15.7 | 2.6.12 | 2.6.12:rc3 | 2.6.12:rc4 | 2.6.12:rc5 | 6.16:rc1 | 6.16:rc2 | 6.16:rc3 | 6.16:rc4 | 6.16:rc5
3 vendors · 151 products
