cve 2025 38460

CVE-2025-38460 is a null-pointer dereference vulnerability in the Linux kernel's ATM CLIP code. The flaw has been fixed upstream, and Microsoft has confirmed that Azure Linux is an attested product that includes the affected open-source library. However, exposure depends on whether other Microsoft products ship a Linux kernel built from a vulnerable tree with ATM/CLIP enabled and older than the upstream fixes. This tag covers discussions about the vulnerability's impact on Microsoft products, particularly Azure Linux, and the conditions under which other systems may be affected.