CVE-2025-38305
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: ptp: remove ptp->n_vclocks check logic in ptp_vclock_in_use() There is no disagreement that we should check both ptp->is_virtual_clock and ptp->n_vclocks to check if the ptp virtual clock is in use. However, when we acquire ptp->n_vclocks_mux to read ptp->n_vclocks in ptp_vclock_in_use(), we observe a recursive lock in the call trace starting from n_vclocks_store(). ============================================ WARNING: possible recursive locking detected 6.15.0-rc6 #1 Not tainted -------------------------------------------- syz.0.1540/13807 is trying to acquire lock: ffff888035a24868 (&ptp->n_vclocks_mux){+.+.}-{4:4}, at: ptp_vclock_in_use drivers/ptp/ptp_private.h:103 [inline] ffff888035a24868 (&ptp->n_vclocks_mux){+.+.}-{4:4}, at: ptp_clock_unregister+0x21/0x250 drivers/ptp/ptp_clock.c:415 but task is already holding lock: ffff888030704868 (&ptp->n_vclocks_mux){+.+.}-{4:4}, at: n_vclocks_store+0xf1/0x6d0 drivers/ptp/ptp_sysfs.c:215 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&ptp->n_vclocks_mux); lock(&ptp->n_vclocks_mux); *** DEADLOCK *** .... ============================================ The best way to solve this is to remove the logic that checks ptp->n_vclocks in ptp_vclock_in_use(). The reason why this is appropriate is that any path that uses ptp->n_vclocks must unconditionally check if ptp->n_vclocks is greater than 0 before unregistering vclocks, and all functions are already written this way. And in the function that uses ptp->n_vclocks, we already get ptp->n_vclocks_mux before unregistering vclocks. Therefore, we need to remove the redundant check for ptp->n_vclocks in ptp_vclock_in_use() to prevent recursive locking.
Severity
MEDIUM
CVSS score
5.5
(v3.1)
Vulnerability status
Analyzed
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2025-07-10 08:15:29.320000
Last modified
2026-11-05 21:18:25.513000
View original CVE JSON
{
"id": "CVE-2025-38305",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-07-10T08:15:29.320",
"lastModified": "2026-11-05T21:18:25.513",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nptp: remove ptp->n_vclocks check logic in ptp_vclock_in_use()\n\nThere is no disagreement that we should check both ptp->is_virtual_clock\nand ptp->n_vclocks to check if the ptp virtual clock is in use.\n\nHowever, when we acquire ptp->n_vclocks_mux to read ptp->n_vclocks in\nptp_vclock_in_use(), we observe a recursive lock in the call trace\nstarting from n_vclocks_store().\n\n============================================\nWARNING: possible recursive locking detected\n6.15.0-rc6 #1 Not tainted\n--------------------------------------------\nsyz.0.1540/13807 is trying to acquire lock:\nffff888035a24868 (&ptp->n_vclocks_mux){+.+.}-{4:4}, at:\n ptp_vclock_in_use drivers/ptp/ptp_private.h:103 [inline]\nffff888035a24868 (&ptp->n_vclocks_mux){+.+.}-{4:4}, at:\n ptp_clock_unregister+0x21/0x250 drivers/ptp/ptp_clock.c:415\n\nbut task is already holding lock:\nffff888030704868 (&ptp->n_vclocks_mux){+.+.}-{4:4}, at:\n n_vclocks_store+0xf1/0x6d0 drivers/ptp/ptp_sysfs.c:215\n\nother info that might help us debug this:\n Possible unsafe locking scenario:\n\n CPU0\n ----\n lock(&ptp->n_vclocks_mux);\n lock(&ptp->n_vclocks_mux);\n\n *** DEADLOCK ***\n....\n============================================\n\nThe best way to solve this is to remove the logic that checks\nptp->n_vclocks in ptp_vclock_in_use().\n\nThe reason why this is appropriate is that any path that uses\nptp->n_vclocks must unconditionally check if ptp->n_vclocks is greater\nthan 0 before unregistering vclocks, and all functions are already\nwritten this way. And in the function that uses ptp->n_vclocks, we\nalready get ptp->n_vclocks_mux before unregistering vclocks.\n\nTherefore, we need to remove the redundant check for ptp->n_vclocks in\nptp_vclock_in_use() to prevent recursive locking."
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ptp: eliminar la lógica de comprobación de ptp->n_vclocks en ptp_vclock_in_use(). No hay desacuerdo en que debemos comprobar tanto ptp->is_virtual_clock como ptp->n_vclocks para comprobar si el reloj virtual ptp está en uso. Sin embargo, al adquirir ptp->n_vclocks_mux para leer ptp->n_vclocks en ptp_vclock_in_use(), observamos un bloqueo recursivo en el seguimiento de llamadas a partir de n_vclocks_store(). ============================================== ADVERTENCIA: posible bloqueo recursivo detectado 6.15.0-rc6 #1 No contaminado -------------------------------------------- syz.0.1540/13807 está intentando adquirir el bloqueo: ffff888035a24868 (&ptp->n_vclocks_mux){+.+.}-{4:4}, en: ptp_vclock_in_use drivers/ptp/ptp_private.h:103 [en línea] ffff888035a24868 (&ptp->n_vclocks_mux){+.+.}-{4:4}, en: ptp_clock_unregister+0x21/0x250 drivers/ptp/ptp_clock.c:415 pero la tarea ya tiene el bloqueo: ffff888030704868 (&ptp->n_vclocks_mux){+.+.}-{4:4}, en: n_vclocks_store+0xf1/0x6d0 drivers/ptp/ptp_sysfs.c:215 otra información que podría ayudarnos a depurar esto: Posible escenario de bloqueo inseguro: CPU0 ---- lock(&ptp->n_vclocks_mux); lock(&ptp->n_vclocks_mux); *** BLOQUEO INTERMEDIO *** .... ============================================== La mejor manera de resolver esto es eliminar la lógica que comprueba ptp->n_vclocks en ptp_vclock_in_use(). Esto es apropiado porque cualquier ruta que use ptp->n_vclocks debe comprobar incondicionalmente si ptp->n_vclocks es mayor que 0 antes de anular el registro de vclocks, y todas las funciones ya están escritas de esta manera. En la función que usa ptp->n_vclocks, ya obtenemos ptp->n_vclocks_mux antes de anular el registro de vclocks. Por lo tanto, necesitamos eliminar la comprobación redundante de ptp->n_vclocks en ptp_vclock_in_use() para evitar el bloqueo recursivo."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"drivers/ptp/ptp_private.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "73f37068d540eba5f93ba3a0019bf479d35ebd76",
"lessThan": "5d217e7031a5c06d366580fc6ddbf43527b780d4",
"versionType": "git",
"status": "affected"
},
{
"version": "73f37068d540eba5f93ba3a0019bf479d35ebd76",
"lessThan": "b1b73c452331451020be3bf4b014901015ae6663",
"versionType": "git",
"status": "affected"
},
{
"version": "73f37068d540eba5f93ba3a0019bf479d35ebd76",
"lessThan": "259119595227fd20f6aa29d85abe086b6fdd9eb1",
"versionType": "git",
"status": "affected"
},
{
"version": "73f37068d540eba5f93ba3a0019bf479d35ebd76",
"lessThan": "b93e6fef4eda48e17d9c642b9abad98a066fd4a3",
"versionType": "git",
"status": "affected"
},
{
"version": "73f37068d540eba5f93ba3a0019bf479d35ebd76",
"lessThan": "ef8fc007c28a30a4c0d90bf755e0f343d99bb392",
"versionType": "git",
"status": "affected"
},
{
"version": "73f37068d540eba5f93ba3a0019bf479d35ebd76",
"lessThan": "87f7ce260a3c838b49e1dc1ceedf1006795157a2",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"drivers/ptp/ptp_private.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "5.14",
"status": "affected"
},
{
"version": "0",
"lessThan": "5.14",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.186",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.142",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.94",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.34",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.15.3",
"lessThanOrEqual": "6.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.16",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-11-05T20:53:36.196517Z",
"id": "CVE-2025-38305",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.14.1",
"versionEndExcluding": "5.15.186",
"matchCriteriaId": "7F369340-2B76-438A-A8D2-7A0F994DC4AC"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.16",
"versionEndExcluding": "6.1.142",
"matchCriteriaId": "459B4E94-FE0E-434D-B782-95E3A5FFC6B1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.2",
"versionEndExcluding": "6.6.94",
"matchCriteriaId": "304E3F01-7D7A-4908-994E-7F95C5C00B06"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.7",
"versionEndExcluding": "6.12.34",
"matchCriteriaId": "4FFA54AA-CDFE-4591-BD07-72813D0948F4"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13",
"versionEndExcluding": "6.15.3",
"matchCriteriaId": "0541C761-BD5E-4C1A-8432-83B375D7EB92"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:5.14:-:*:*:*:*:*:*",
"matchCriteriaId": "6A05198E-F8FA-4517-8D0E-8C95066AED38"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:5.14:rc2:*:*:*:*:*:*",
"matchCriteriaId": "23B9E5C6-FAB5-4A02-9E39-27C8787B0991"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:5.14:rc3:*:*:*:*:*:*",
"matchCriteriaId": "D185CF67-7E4A-4154-93DB-CE379C67DB56"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:5.14:rc4:*:*:*:*:*:*",
"matchCriteriaId": "D1DA0AF6-02F4-47C7-A318-8C006ED0C665"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:5.14:rc5:*:*:*:*:*:*",
"matchCriteriaId": "49DD30B1-8C99-4C38-A66B-CAB3827BEE8A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:5.14:rc6:*:*:*:*:*:*",
"matchCriteriaId": "15013998-4AF0-4CDC-AB13-829ECD8A8E66"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:5.14:rc7:*:*:*:*:*:*",
"matchCriteriaId": "376A25CF-C05B-48F1-99B1-8FB0314A8E06"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*",
"matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01"
}
]
}
]
},
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/259119595227fd20f6aa29d85abe086b6fdd9eb1",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/5d217e7031a5c06d366580fc6ddbf43527b780d4",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/87f7ce260a3c838b49e1dc1ceedf1006795157a2",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/b1b73c452331451020be3bf4b014901015ae6663",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/b93e6fef4eda48e17d9c642b9abad98a066fd4a3",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/ef8fc007c28a30a4c0d90bf755e0f343d99bb392",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
]
}
]
}