CVE-2025-40298: gve: Implement settime64 with -EOPNOTSUPP
In the Linux kernel, the following vulnerability has been resolved:
gve: Implement settime64 with -EOPNOTSUPP
ptpclocksettime() assumes every ptpclock has implemented settime64(). Stub it with -EOPNOTSUPP to prevent a NULL dereference.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Implement settime64() to return -EOPNOTSUPP, preventing ptp_clock_settime() from dereferencing a NULL function pointer.
gve PTP clock settime64() = -EOPNOTSUPP
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40298?
CVE-2025-40298 is classified as a moderate severity vulnerability due to the potential for a NULL dereference.
How do I fix CVE-2025-40298?
To fix CVE-2025-40298, update to the latest stable version of the Linux kernel that includes the patch for this vulnerability.
What systems are affected by CVE-2025-40298?
CVE-2025-40298 specifically affects the Linux kernel on systems utilizing PTP (Precision Time Protocol) clocks.
What is the impact of CVE-2025-40298?
The impact of CVE-2025-40298 can lead to application crashes due to a NULL dereference if settime64 is not properly implemented.
When was CVE-2025-40298 discovered?
CVE-2025-40298 was resolved in a recent Linux kernel update, although the exact discovery date is not specified in the documentation.