CVE-2025-38305

MEDIUM EPSS 4.2%
Published Jul 10, 202511mo ago · Modified Jun 17, 20261w ago
5.5 CVSS 3.1
Medium
Find Similar
Published Jul 10, 2025 11mo ago
Last Modified Jun 17, 2026 1w ago

Description

In the Linux kernel, the following vulnerability has been resolved: ptp: remove ptp->n_vclocks check logic in ptp_vclock_in_use() There is no disagreement that we should check both ptp->is_virtual_clock and ptp->n_vclocks to check if the ptp virtual clock is in use. However, when we acquire ptp->n_vclocks_mux to read ptp->n_vclocks in ptp_vclock_in_use(), we observe a recursive lock in the call trace starting from n_vclocks_store(). ============================================ WARNING: possible recursive locking detected 6.15.0-rc6 #1 Not tainted -------------------------------------------- syz.0.1540/13807 is trying to acquire lock: ffff888035a24868 (&ptp->n_vclocks_mux){+.+.}-{4:4}, at: ptp_vclock_in_use drivers/ptp/ptp_private.h:103 [inline] ffff888035a24868 (&ptp->n_vclocks_mux){+.+.}-{4:4}, at: ptp_clock_unregister+0x21/0x250 drivers/ptp/ptp_clock.c:415 but task is already holding lock: ffff888030704868 (&ptp->n_vclocks_mux){+.+.}-{4:4}, at: n_vclocks_store+0xf1/0x6d0 drivers/ptp/ptp_sysfs.c:215 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&ptp->n_vclocks_mux); lock(&ptp->n_vclocks_mux); *** DEADLOCK *** .... ============================================ The best way to solve this is to remove the logic that checks ptp->n_vclocks in ptp_vclock_in_use(). The reason why this is appropriate is that any path that uses ptp->n_vclocks must unconditionally check if ptp->n_vclocks is greater than 0 before unregistering vclocks, and all functions are already written this way. And in the function that uses ptp->n_vclocks, we already get ptp->n_vclocks_mux before unregistering vclocks. Therefore, we need to remove the redundant check for ptp->n_vclocks in ptp_vclock_in_use() to prevent recursive locking.

CVSS Details

Base Score
5.5
Exploitability
1.8
Impact
3.6
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
4.2% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Affected Products 14

VendorProductVersionRange
linuxlinux_kernel*≥5.14.1  –  <5.15.186
linuxlinux_kernel*≥5.16  –  <6.1.142
linuxlinux_kernel*≥6.2  –  <6.6.94
linuxlinux_kernel*≥6.7  –  <6.12.34
linuxlinux_kernel*≥6.13  –  <6.15.3
linuxlinux_kernel5.14any
linuxlinux_kernel5.14any
linuxlinux_kernel5.14any
linuxlinux_kernel5.14any
linuxlinux_kernel5.14any
linuxlinux_kernel5.14any
linuxlinux_kernel5.14any
linuxlinux_kernel6.16any
debiandebian_linux11.0any

References 7

  • git.kernel.org https://git.kernel.org/stable/c/259119595227fd20f6aa29d85abe086b6fdd9eb1
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/5d217e7031a5c06d366580fc6ddbf43527b780d4
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/87f7ce260a3c838b49e1dc1ceedf1006795157a2
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/b1b73c452331451020be3bf4b014901015ae6663
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/b93e6fef4eda48e17d9c642b9abad98a066fd4a3
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/ef8fc007c28a30a4c0d90bf755e0f343d99bb392
    Patch
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
    Third Party Advisory

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/259119595227fd20f6aa29d85abe086b6fdd9eb1
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/5d217e7031a5c06d366580fc6ddbf43527b780d4
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/87f7ce260a3c838b49e1dc1ceedf1006795157a2
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/b1b73c452331451020be3bf4b014901015ae6663
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/b93e6fef4eda48e17d9c642b9abad98a066fd4a3
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/ef8fc007c28a30a4c0d90bf755e0f343d99bb392
    Patch