CVE-2025-38542

Отчет

A low impact denial of service flaw was found in the Linux kernel's Appletalk protocol implementation. When updating an existing route entry in atrtr_create(), the reference held on the previously assigned network device was not released before the new device reference was taken, resulting in a device reference count leak. A local user with low privileges could trigger this leak repeatedly to exhaust kernel resources, leading to system instability or unresponsiveness. No confidentiality or integrity impact is possible because a reference count leak only affects availability, which is why Red Hat rates this flaw Low severity with a CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), lower than the 7.8 score in the upstream CVE record that also claims high confidentiality and integrity impacts not supported by the nature of this flaw. The vulnerable code is not present in the Red Hat Enterprise Linux 7, 8, 9, and 10 kernels, nor in the Red Hat In-Vehicle OS kernels, so those products are not affected. The only affected stream, Red Hat Enterprise Linux 6, is out of support scope and will not receive a fix; the residual risk is limited to local denial of service on those unsupported legacy systems.

Меры по смягчению последствий

To mitigate this issue on affected Red Hat Enterprise Linux 6 ELS systems, and as a general hardening measure on other systems where Appletalk is not required, prevent the appletalk kernel module from loading. This can be achieved by creating a modprobe configuration file. Create a file named /etc/modprobe.d/disable-appletalk.conf with the following content:

After creating the file, regenerate the initramfs and reboot the system for the changes to take effect. This may impact functionality if Appletalk services are actively used.