CVE-2025-38305: ptp: remove ptp->n_vclocks check logic in ptp_vclock_in_use()
In the Linux kernel, the following vulnerability has been resolved:
ptp: remove ptp->nvclocks check logic in ptpvclockinuse()
There is no disagreement that we should check both ptp->isvirtualclock and ptp->nvclocks to check if the ptp virtual clock is in use.
However, when we acquire ptp->nvclocksmux to read ptp->nvclocks in ptpvclockinuse(), we observe a recursive lock in the call trace starting from nvclocksstore().
============================================ WARNING: possible recursive locking detected 6.15.0-rc6 #1 Not tainted -------------------------------------------- syz.0.1540/13807 is trying to acquire lock: ffff888035a24868 (&ptp->nvclocksmux){+.+.}-{4:4}, at: ptpvclockinuse drivers/ptp/ptpprivate.h:103 [inline] ffff888035a24868 (&ptp->nvclocksmux){+.+.}-{4:4}, at: ptpclockunregister+0x21/0x250 drivers/ptp/ptpclock.c:415
but task is already holding lock: ffff888030704868 (&ptp->nvclocksmux){+.+.}-{4:4}, at: nvclocksstore+0xf1/0x6d0 drivers/ptp/ptpsysfs.c:215
other info that might help us debug this: Possible unsafe locking scenario:
CPU0 ---- lock(&ptp->nvclocksmux); lock(&ptp->nvclocksmux);
DEADLOCK .... ============================================
The best way to solve this is to remove the logic that checks ptp->nvclocks in ptpvclockinuse().
The reason why this is appropriate is that any path that uses ptp->nvclocks must unconditionally check if ptp->nvclocks is greater than 0 before unregistering vclocks, and all functions are already written this way. And in the function that uses ptp->nvclocks, we already get ptp->nvclocksmux before unregistering vclocks.
Therefore, we need to remove the redundant check for ptp->nvclocks in ptpvclockinuse() to prevent recursive locking.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
In the Linux kernel PTP subsystem, remove the redundant ptp->n_vclocks check logic from ptp_vclock_in_use(); retain the ptp->is_virtual_clock check to prevent recursive locking on ptp->n_vclocks_mux.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38305?
The severity of CVE-2025-38305 has not been explicitly detailed, but vulnerabilities in the Linux kernel often have high potential impact.
How do I fix CVE-2025-38305?
To fix CVE-2025-38305, update to the latest version of the Linux kernel where the vulnerability has been patched.
What systems are affected by CVE-2025-38305?
CVE-2025-38305 affects various versions of the Linux kernel that utilize the ptp (Precision Time Protocol) functionality.
What impact does CVE-2025-38305 have on system security?
CVE-2025-38305 may lead to unintended behavior in virtual clock functionality, potentially impacting system stability and time-sensitive operations.
Is CVE-2025-38305 publicly known?
Yes, CVE-2025-38305 is a publicly disclosed vulnerability in the Linux kernel.