CVE-2025-40299: gve: Implement gettimex64 with -EOPNOTSUPP
In the Linux kernel, the following vulnerability has been resolved:
gve: Implement gettimex64 with -EOPNOTSUPP
gve implemented a ptpclock for sole use of doauxwork at this time. ptpclockgettime() and ptpsysoffset() assume every ptpclock has implemented either gettimex64 or gettime64. Stub gettimex64 and return -EOPNOTSUPP to prevent NULL dereferencing.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In the gve PTP clock implementation, stub gettimex64 and have it return -EOPNOTSUPP to prevent NULL dereferencing.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40299?
The severity of CVE-2025-40299 has not been specified publicly, but it pertains to a vulnerability in the Linux kernel's clock functionality.
How do I fix CVE-2025-40299?
To fix CVE-2025-40299, you should update your Linux kernel to the latest version that resolves this issue.
Which versions of the Linux kernel are affected by CVE-2025-40299?
CVE-2025-40299 affects specific versions of the Linux kernel that utilize the gve ptp_clock implementation.
What are the potential impacts of CVE-2025-40299?
The potential impacts of CVE-2025-40299 could include incorrect time handling in applications relying on precise timing functionalities.
How can I verify if my system is vulnerable to CVE-2025-40299?
You can verify if your system is vulnerable to CVE-2025-40299 by checking the Linux kernel version and consulting your distribution's security advisories.