CVE-2025-38126: net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping
In the Linux kernel, the following vulnerability has been resolved:
net: stmmac: make sure that ptprate is not 0 before configuring timestamping
The stmmac platform drivers that do not open-code the clkptprate value after having retrieved the default one from the device-tree can end up with 0 in clkptprate (as clkgetrate can return 0). It will eventually propagate up to PTP initialization when bringing up the interface, leading to a divide by 0:
Division by zero in kernel. CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.12.30-00001-g48313bd5768a #22 Hardware name: STM32 (Device Tree Support) Call trace: unwindbacktrace from showstack+0x18/0x1c showstack from dumpstacklvl+0x6c/0x8c dumpstacklvl from Ldiv064+0x8/0x18 Ldiv064 from stmmacinittstampcounter+0x190/0x1a4 stmmacinittstampcounter from stmmachwsetup+0xc1c/0x111c stmmachwsetup from stmmacopen+0x18c/0x434 stmmacopen from stmmacopen+0x3c/0xbc stmmacopen from devopen+0xf4/0x1ac devopen from devchangeflags+0x1cc/0x224 devchangeflags from devchangeflags+0x24/0x60 devchangeflags from ipautoconfig+0x2e8/0x11a0 ipautoconfig from dooneinitcall+0x84/0x33c dooneinitcall from kernelinitfreeable+0x1b8/0x214 kernelinitfreeable from kernelinit+0x24/0x140 kernelinit from retfromfork+0x14/0x28 Exception stack(0xe0815fb0 to 0xe0815ff8)
Prevent this division by 0 by adding an explicit check and error log about the actual issue. While at it, remove the same check from stmmacptpregister, which then becomes duplicate
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38126?
CVE-2025-38126 is considered a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2025-38126?
To fix CVE-2025-38126, update your Linux kernel to the latest version that addresses this vulnerability.
What systems are affected by CVE-2025-38126?
CVE-2025-38126 affects systems running specific versions of the Linux kernel that utilize stmmac platform drivers.
What type of vulnerability is CVE-2025-38126?
CVE-2025-38126 is a configuration vulnerability related to timestamping in network drivers of the Linux kernel.
Is there a workaround for CVE-2025-38126?
There are no known workarounds for CVE-2025-38126, updating the kernel is the recommended action.