Overview
CVE-2025-40255 describes a vulnerability in the Linux kernel’s networking subsystem. Specifically, a potential NULL pointer dereference in the generic_hwtstamp_ioctl_lower() function can be triggered through a carefully crafted ethtool tsconfig Netlink path. This vulnerability, if exploited, could lead to a kernel panic and system crash. A patch has been released to address this issue by implementing a NULL check before dereferencing the potentially problematic pointer.
Technical Details
The vulnerability resides in the generic_hwtstamp_ioctl_lower() function within the Linux kernel’s networking code. The exploit path begins with a Netlink message configuring ethtool timestamping (tsconfig). The vulnerable call chain is as follows:
tsconfig_prepare_data()dev_get_hwtstamp_phylib()vlan_hwtstamp_get()generic_hwtstamp_get_lower()generic_hwtstamp_ioctl_lower()
Under certain conditions, this call chain can result in generic_hwtstamp_ioctl_lower() being invoked with kernel_cfg->ifr as a NULL pointer. The function then proceeds to dereference this NULL pointer, leading to a kernel panic and system crash.
The root cause is the lack of a NULL check for kernel_cfg->ifr within the generic_hwtstamp_ioctl_lower() function before it is dereferenced.
CVSS Analysis
Due to the potential for a kernel panic, this vulnerability is considered to have a significant impact on system availability. However, without assigned CVSS score, it is hard to judge its true severity. The vulnerability could allow a local attacker with appropriate privileges to cause a denial-of-service condition. The fact that specialized netlink messages and ethtool configuration are needed means the attack vector complexity is high.
CVSS Score: N/A
Severity: N/A
Possible Impact
The primary impact of this vulnerability is a denial-of-service (DoS) condition caused by a kernel panic. A successful exploit would result in a system crash, requiring a reboot to restore functionality. This could lead to data loss or service interruption, depending on the specific system and its configuration.
Mitigation and Patch Steps
The vulnerability is addressed by adding a NULL check for kernel_cfg->ifr within the generic_hwtstamp_ioctl_lower() function. If ifr is NULL, the function now returns -EINVAL, preventing the NULL pointer dereference and the subsequent kernel panic.
To mitigate this vulnerability, users are advised to:
- Apply the latest kernel patches from their Linux distribution vendor.
- Upgrade to a kernel version that includes the fix for CVE-2025-40255.
The fix is available in the following kernel commits:
