CVE-2025-40175: idpf: cleanup remaining SKBs in PTP flows
In the Linux kernel, the following vulnerability has been resolved:
idpf: cleanup remaining SKBs in PTP flows
When the driver requests Tx timestamp value, one of the first steps is to clone SKB using skbget. It increases the reference counter for that SKB to prevent unexpected freeing by another component. However, there may be a case where the index is requested, SKB is assigned and never consumed by PTP flows - for example due to reset during running PTP apps.
Add a check in release timestamping function to verify if the SKB assigned to Tx timestamp latch was freed, and release remaining SKBs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Update the idpf PTP Tx timestamping flow to verify the SKB in the release timestamping function, increment its reference counter with skb_get before cloning it, and clean up remaining SKBs when assigned Tx timestamp latches are not consumed, including after a reset.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40175?
CVE-2025-40175 has been classified as a moderate severity vulnerability affecting the Linux kernel.
How do I fix CVE-2025-40175?
To fix CVE-2025-40175, ensure that you update the Linux kernel to the latest stable version where the vulnerability has been addressed.
What does CVE-2025-40175 affect?
CVE-2025-40175 affects specific networking features in the Linux kernel, particularly related to Time Protocol (PTP) flows.
Can CVE-2025-40175 be exploited remotely?
CVE-2025-40175 does not appear to allow for remote exploitation, but it could impact systems where the affected functionality is used.
Is there a workaround for CVE-2025-40175?
Currently, there are no documented workarounds for CVE-2025-40175, thus applying the kernel update is the recommended approach.