CVE-2025-40255: net: core: prevent NULL deref in generic_hwtstamp_ioctl_lower()
In the Linux kernel, the following vulnerability has been resolved:
net: core: prevent NULL deref in generichwtstampioctllower()
The ethtool tsconfig Netlink path can trigger a null pointer dereference. A call chain such as:
tsconfigpreparedata() -> devgethwtstampphylib() -> vlanhwtstampget() -> generichwtstampgetlower() -> generichwtstampioctllower()
results in generichwtstampioctllower() being called with kernelcfg->ifr as NULL.
The generichwtstampioctllower() function does not expect a NULL ifr and dereferences it, leading to a system crash.
Fix this by adding a NULL check for kernelcfg->ifr in generichwtstampioctllower(). If ifr is NULL, return -EINVAL.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Add a NULL check for kernel_cfg->ifr in generic_hwtstamp_ioctl_lower(); if ifr is NULL, return -EINVAL.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40255?
CVE-2025-40255 has been rated as a medium severity vulnerability due to its potential to cause application crashes or unexpected behavior.
How do I fix CVE-2025-40255?
To fix CVE-2025-40255, you should upgrade to the latest patched version of the Linux kernel that addresses the null pointer dereference issue.
What systems are affected by CVE-2025-40255?
CVE-2025-40255 affects various versions of the Linux kernel that may utilize the ethtool tsconfig Netlink path.
What are the potential impacts of CVE-2025-40255?
The potential impacts of CVE-2025-40255 include system crashes and denial of service conditions caused by null pointer dereferences.
Is there a workaround for CVE-2025-40255?
While the recommended solution is to upgrade, users may mitigate risks by disabling features related to the ethtool tsconfig if not required.