CVE-2025-38126: net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping

Published Jul 3, 2025
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

net: stmmac: make sure that ptprate is not 0 before configuring timestamping

The stmmac platform drivers that do not open-code the clkptprate value after having retrieved the default one from the device-tree can end up with 0 in clkptprate (as clkgetrate can return 0). It will eventually propagate up to PTP initialization when bringing up the interface, leading to a divide by 0:

Division by zero in kernel. CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.12.30-00001-g48313bd5768a #22 Hardware name: STM32 (Device Tree Support) Call trace: unwindbacktrace from showstack+0x18/0x1c showstack from dumpstacklvl+0x6c/0x8c dumpstacklvl from Ldiv064+0x8/0x18 Ldiv064 from stmmacinittstampcounter+0x190/0x1a4 stmmacinittstampcounter from stmmachwsetup+0xc1c/0x111c stmmachwsetup from stmmacopen+0x18c/0x434 stmmacopen from stmmacopen+0x3c/0xbc stmmacopen from devopen+0xf4/0x1ac devopen from devchangeflags+0x1cc/0x224 devchangeflags from devchangeflags+0x24/0x60 devchangeflags from ipautoconfig+0x2e8/0x11a0 ipautoconfig from dooneinitcall+0x84/0x33c dooneinitcall from kernelinitfreeable+0x1b8/0x214 kernelinitfreeable from kernelinit+0x24/0x140 kernelinit from retfromfork+0x14/0x28 Exception stack(0xe0815fb0 to 0xe0815ff8)

Prevent this division by 0 by adding an explicit check and error log about the actual issue. While at it, remove the same check from stmmacptpregister, which then becomes duplicate

Affected Software

9 affected componentsFixes available
Linux Kernel
Linux Linux kernel>=4.5<6.1.142
Linux Linux kernel>=6.2<6.6.94
Linux Linux kernel>=6.7<6.12.34
Linux Linux kernel>=6.13<6.15.3
Debian Debian Linux=11.0
Microsoft cbl2 kernel 5.15.186.1-1
Microsoft azl3 kernel 6.6.96.1-1
Microsoft azl3 kernel 6.6.92.2-2

Event History

Jul 3, 2025
CVE Published
via MITRE·08:35 AM
Data Sourced
via MITRE·08:35 AM
Description
Data Sourced
via NVD·09:15 AM
RemedyDescriptionSeverityWeaknessAffected Software
Aug 7, 2025
Data Sourced
via Microsoft·12:00 AM
DescriptionSeverityWeaknessAffected Software
Updated
via Microsoft·07:00 AM
DescriptionSeverity
Updated
via Microsoft·07:00 AM
SeverityAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2025-38126?

CVE-2025-38126 is considered a medium severity vulnerability in the Linux kernel.

2

How do I fix CVE-2025-38126?

To fix CVE-2025-38126, update your Linux kernel to the latest version that addresses this vulnerability.

3

What systems are affected by CVE-2025-38126?

CVE-2025-38126 affects systems running specific versions of the Linux kernel that utilize stmmac platform drivers.

4

What type of vulnerability is CVE-2025-38126?

CVE-2025-38126 is a configuration vulnerability related to timestamping in network drivers of the Linux kernel.

5

Is there a workaround for CVE-2025-38126?

There are no known workarounds for CVE-2025-38126, updating the kernel is the recommended action.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203