CVE-2025-40239

Vulnerability

Analysis

Root Cause: In the LAN8814 PTP probe function within the Linux kernel's micrel PHY driver, the shared->phydev pointer is only set if the PTP clock initialization succeeds. If the PTP clock setup fails, the function returns early without assigning shared->phydev. This missing assignment leaves the pointer as NULL.

Exploitation: The vulnerability manifests during interrupt handling. When an IRQ occurs, the handler calls lan8814_gpio_process_cap, which unconditionally dereferences shared->phydev. If the pointer is NULL, this dereference causes a NULL pointer exception, leading to a kernel crash. An attacker with the ability to trigger an interrupt on the affected hardware (e.g., via network packets or PHY events) could cause a denial-of-service condition.

Impact: Successful exploitation results in a kernel crash (system panic), effectively causing a denial of service (DoS). The vulnerability does not require authentication or special privileges beyond having the affected hardware present and being able to generate PHY interrupts. No remote code execution or privilege escalation is implied by the description.

Mitigation: The fix is a one-line change to always set shared->phydev regardless of PTP clock setup outcome. The commit is applied to the stable kernel tree [1]. Users should update to a kernel version containing this commit. No workaround is mentioned; the issue is resolved by the patch.