CVE-2025-40057

Vulnerability

The ptp driver in the Linux kernel did not enforce an upper bound on the max argument passed to max_vclocks_store. When a very large value is provided, kcalloc may fail due to excessive size, triggering a kernel WARNING [1][2].

Exploitation

An attacker with ability to write to the max_vclocks sysfs file can cause this by specifying an oversized integer. No special privileges beyond write access to the sysfs attribute are needed, though such access typically requires root or CAP_SYS_ADMIN.

Impact

Successful exploitation results in a kernel WARNING, which may indicate denial of service (system log spam, potential panic depending on configuration). No memory corruption or privilege escalation is reported.

Mitigation

The fix adds an explicit upper bound check, ensuring the value fits within the limits that kcalloc can safely allocate. Patches have been applied to the stable kernel trees referenced [1][2].