CVE-2025-38054: ptp: ocp: Limit signal/freq counts in summary output functions
In the Linux kernel, the following vulnerability has been resolved:
ptp: ocp: Limit signal/freq counts in summary output functions
The debugfs summary output could access uninitialized elements in the freqin[] and signalout[] arrays, causing NULL pointer dereferences and triggering a kernel Oops (pagefaultoops). This patch adds u8 fields (nrfreqin, nrsignalout) to track the number of initialized elements, with a maximum of 4 per array. The summary output functions are updated to respect these limits, preventing out-of-bounds access and ensuring safe array handling.
Widen the label variables because the change confuses GCC about max length of the strings.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38054?
CVE-2025-38054 has a severity rating that may impact the stability of the Linux kernel due to potential NULL pointer dereferences.
How do I fix CVE-2025-38054?
To fix CVE-2025-38054, it is recommended to update to the latest version of the Linux kernel that contains the patch.
What products are affected by CVE-2025-38054?
CVE-2025-38054 affects the Linux kernel across various distributions where the vulnerable versions are utilized.
What types of issues can CVE-2025-38054 cause?
CVE-2025-38054 can result in system crashes or instability due to uninitialized elements leading to NULL pointer dereferences.
Is there a workaround for CVE-2025-38054?
There is no specific workaround for CVE-2025-38054; patching the kernel is the recommended mitigation.