CVE-2025-40175

{
  "id": "CVE-2025-40175",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2025-11-12T11:15:48.020",
  "lastModified": "2026-10-19T21:10:00.160",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nidpf: cleanup remaining SKBs in PTP flows\n\nWhen the driver requests Tx timestamp value, one of the first steps is\nto clone SKB using skb_get. It increases the reference counter for that\nSKB to prevent unexpected freeing by another component.\nHowever, there may be a case where the index is requested, SKB is\nassigned and never consumed by PTP flows - for example due to reset during\nrunning PTP apps.\n\nAdd a check in release timestamping function to verify if the SKB\nassigned to Tx timestamp latch was freed, and release remaining SKBs."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nidpf: limpieza de los SKB restantes en los flujos PTP\n\nCuando el controlador solicita el valor de la marca de tiempo Tx, uno de los primeros pasos es clonar el SKB usando skb_get. Aumenta el contador de referencias para ese SKB para evitar la liberación inesperada por otro componente.\nSin embargo, puede haber un caso en el que se solicita el índice, se asigna el SKB y nunca es consumido por los flujos PTP, por ejemplo, debido a un reinicio durante la ejecución de aplicaciones PTP.\n\nAñadir una comprobación en la función de liberación de marcas de tiempo para verificar si el SKB asignado al *latch* de la marca de tiempo Tx fue liberado, y liberar los SKB restantes."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "drivers/net/ethernet/intel/idpf/idpf_ptp.c",
            "drivers/net/ethernet/intel/idpf/idpf_virtchnl_ptp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "4901e83a94ef0a8baf27916f31daf59b0a68547f",
              "lessThan": "2c84e91ef831d4fedb0b94670b3cfd1cc5f966a5",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "4901e83a94ef0a8baf27916f31daf59b0a68547f",
              "lessThan": "a3f8c0a273120fd2638f03403e786c3de2382e72",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "drivers/net/ethernet/intel/idpf/idpf_ptp.c",
            "drivers/net/ethernet/intel/idpf/idpf_virtchnl_ptp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "6.16",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "6.16",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.17.5",
              "lessThanOrEqual": "6.17.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/2c84e91ef831d4fedb0b94670b3cfd1cc5f966a5",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a3f8c0a273120fd2638f03403e786c3de2382e72",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}