{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-68215", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-12-16T13:41:40.256Z", "datePublished": "2025-12-16T13:57:10.576Z", "dateUpdated": "2026-08-05T12:10:15.993Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:10:15.993Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: fix PTP cleanup on driver removal in error path\n\nImprove the cleanup on releasing PTP resources in error path.\nThe error case might happen either at the driver probe and PTP\nfeature initialization or on PTP restart (errors in reset handling, NVM\nupdate etc). In both cases, calls to PF PTP cleanup (ice_ptp_cleanup_pf\nfunction) and 'ps_lock' mutex deinitialization were missed.\nAdditionally, ptp clock was not unregistered in the latter case.\n\nKeep PTP state as 'uninitialized' on init to distinguish between error\nscenarios and to avoid resource release duplication at driver removal.\n\nThe consequence of missing ice_ptp_cleanup_pf call is the following call\ntrace dumped when ice_adapter object is freed (port list is not empty,\nas it is required at this stage):\n\n[ T93022] ------------[ cut here ]------------\n[ T93022] WARNING: CPU: 10 PID: 93022 at\nice/ice_adapter.c:67 ice_adapter_put+0xef/0x100 [ice]\n...\n[ T93022] RIP: 0010:ice_adapter_put+0xef/0x100 [ice]\n...\n[ T93022] Call Trace:\n[ T93022] \n[ T93022] ? ice_adapter_put+0xef/0x100 [ice\n33d2647ad4f6d866d41eefff1806df37c68aef0c]\n[ T93022] ? __warn.cold+0xb0/0x10e\n[ T93022] ? ice_adapter_put+0xef/0x100 [ice\n33d2647ad4f6d866d41eefff1806df37c68aef0c]\n[ T93022] ? report_bug+0xd8/0x150\n[ T93022] ? handle_bug+0xe9/0x110\n[ T93022] ? exc_invalid_op+0x17/0x70\n[ T93022] ? asm_exc_invalid_op+0x1a/0x20\n[ T93022] ? ice_adapter_put+0xef/0x100 [ice\n33d2647ad4f6d866d41eefff1806df37c68aef0c]\n[ T93022] pci_device_remove+0x42/0xb0\n[ T93022] device_release_driver_internal+0x19f/0x200\n[ T93022] driver_detach+0x48/0x90\n[ T93022] bus_remove_driver+0x70/0xf0\n[ T93022] pci_unregister_driver+0x42/0xb0\n[ T93022] ice_module_exit+0x10/0xdb0 [ice\n33d2647ad4f6d866d41eefff1806df37c68aef0c]\n...\n[ T93022] ---[ end trace 0000000000000000 ]---\n[ T93022] ice: module unloaded" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The strongest attacker-reachable path is local: after PTP restart failure and driver removal, the still-registered PTP character device invokes callbacks through a structure embedded in the freed PF. This is not directly reachable through received network packets.\nAC:H - Exploitation requires a PTP initialization or rebuild failure followed by driver teardown, conditions an unprivileged attacker generally cannot force. Once this state exists, the persistent dangling PTP interface is reliably callable without winning a race.\nPR:L - An ordinary local user with read access to the PTP device can invoke time and offset operations that lack capability checks. Initiating reset or removal requires host administration, but that need not be performed by the attacker.\nUI:N - No human victim action is intrinsically required because reset failure and removal can result from firmware events, PCI error recovery, hotplug, shutdown, or automated device management.\nS:U - Exploitation affects the host kernel within the same security authority; ordinary kernel privilege escalation does not constitute a scope change.\nC:H - The dangling ptp_clock_info and pin_config pointers can be reclaimed and manipulated, enabling stale-pointer dereferences and potentially arbitrary kernel-memory reads.\nI:H - Reclaiming the freed PF allocation can provide control over PTP callback pointers, making control-flow hijacking and arbitrary kernel-memory modification defensible impacts.\nA:H - The stale adapter-list node and PTP callbacks can cause use-after-free accesses, invalid indirect calls, kernel oopses, or panics; the observed WARN can also be fatal under panic-on-warn configurations." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/intel/ice/ice_ptp.c" ], "versions": [ { "version": "2f59743be4d9568cad2d9cf697d1b897975421ed", "lessThan": "f5eb91f876ebecbcd90f9edcaea98dcb354603b3", "status": "affected", "versionType": "git" }, { "version": "e800654e85b5b27966fc6493201f5f8cf658beb6", "lessThan": "765236f2c4fbba7650436b71a0e350500e9ec15f", "status": "affected", "versionType": "git" }, { "version": "e800654e85b5b27966fc6493201f5f8cf658beb6", "lessThan": "23a5b9b12de9dcd15ebae4f1abc8814ec1c51ab0", "status": "affected", "versionType": "git" }, { "version": "6.12.11", "lessThan": "6.12.60", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/intel/ice/ice_ptp.c" ], "versions": [ { "version": "6.13", "status": "affected" }, { "version": "0", "lessThan": "6.13", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.60", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.17.10", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.11", "versionEndExcluding": "6.12.60" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.17.10" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.18" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/f5eb91f876ebecbcd90f9edcaea98dcb354603b3" }, { "url": "https://git.kernel.org/stable/c/765236f2c4fbba7650436b71a0e350500e9ec15f" }, { "url": "https://git.kernel.org/stable/c/23a5b9b12de9dcd15ebae4f1abc8814ec1c51ab0" } ], "title": "ice: fix PTP cleanup on driver removal in error path", "x_generator": { "engine": "bippy-1.2.0" } } } }