CVE-2025-40255

In the Linux kernel, the following vulnerability has been resolved: net: core: prevent NULL deref in generic_hwtstamp_ioctl_lower() The ethtool tsconfig Netlink path can trigger a null pointer dereference. A call chain such as: tsconfig_prepare_data() -> dev_get_hwtstamp_phylib() -> vlan_hwtstamp_get() -> generic_hwtstamp_get_lower() -> generic_hwtstamp_ioctl_lower() results in generic_hwtstamp_ioctl_lower() being called with kernel_cfg->ifr as NULL. The generic_hwtstamp_ioctl_lower() function does not expect a NULL ifr and dereferences it, leading to a system crash. Fix this by adding a NULL check for kernel_cfg->ifr in generic_hwtstamp_ioctl_lower(). If ifr is NULL, return -EINVAL.

CVSS

No CVSS.

References

Link	Resource
https://git.kernel.org/stable/c/8817f816ae41908e9625c0770c4af0dcdcc01238
https://git.kernel.org/stable/c/f796a8dec9beafcc0f6f0d3478ed685a15c5e062

Configurations

No configuration.

History

No history.

Information

Published : 2025-12-04 16:16

Updated : 2026-06-17 09:21

NVD link : CVE-2025-40255

Mitre link : CVE-2025-40255

CVE.ORG link : CVE-2025-40255

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2025-40255", "cveTags": [], "metrics": {}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6e9e2eed4f39d52edf5fd006409d211facf49f6b", "lessThan": "8817f816ae41908e9625c0770c4af0dcdcc01238", "versionType": "git"}, {"status": "affected", "version": "6e9e2eed4f39d52edf5fd006409d211facf49f6b", "lessThan": "f796a8dec9beafcc0f6f0d3478ed685a15c5e062", "versionType": "git"}], "programFiles": ["net/core/dev_ioctl.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.14"}, {"status": "unaffected", "version": "0", "lessThan": "6.14", "versionType": "semver"}, {"status": "unaffected", "version": "6.17.10", "versionType": "semver", "lessThanOrEqual": "6.17.*"}, {"status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/core/dev_ioctl.c"], "defaultStatus": "affected"}]}], "published": "2025-12-04T16:16:19.227", "references": [{"url": "https://git.kernel.org/stable/c/8817f816ae41908e9625c0770c4af0dcdcc01238", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/f796a8dec9beafcc0f6f0d3478ed685a15c5e062", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Deferred", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: core: prevent NULL deref in generic_hwtstamp_ioctl_lower()\n\nThe ethtool tsconfig Netlink path can trigger a null pointer\ndereference. A call chain such as:\n\n tsconfig_prepare_data() ->\n dev_get_hwtstamp_phylib() ->\n vlan_hwtstamp_get() ->\n generic_hwtstamp_get_lower() ->\n generic_hwtstamp_ioctl_lower()\n\nresults in generic_hwtstamp_ioctl_lower() being called with\nkernel_cfg->ifr as NULL.\n\nThe generic_hwtstamp_ioctl_lower() function does not expect\na NULL ifr and dereferences it, leading to a system crash.\n\nFix this by adding a NULL check for kernel_cfg->ifr in\ngeneric_hwtstamp_ioctl_lower(). If ifr is NULL, return -EINVAL."}], "lastModified": "2026-06-17T09:21:32.437", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}