CVE-2025-40298

Vulnerability

Overview

The Linux kernel's gve (Google Virtual Ethernet) driver did not implement the settime64() callback for its PTP clock. The ptp_clock_settime() function assumes every PTP clock has this callback implemented; calling it on the gve PTP clock would lead to a NULL pointer dereference, causing a kernel crash or potential denial of service [1].

Exploitation

Scenario

An attacker with the ability to invoke PTP clock operations on the gve device—typically requiring local access or privileged control over the network interface—could trigger the NULL dereference. No special authentication beyond the ability to interact with the PTP subsystem is needed; the bug is reachable through normal PTP syscalls or ioctls.

Impact

Successful exploitation results in a kernel panic (denial of service). There is no indication of memory corruption or privilege escalation from this bug; the primary risk is system instability or downtime.

Mitigation

The fix, committed to the Linux kernel stable tree, implements settime64() to return -EOPNOTSUPP, preventing the NULL pointer dereference. Users should apply the latest kernel updates from their distribution or vendor [1].