CVE-2025-68215 (GCVE-0-2025-68215)

Vulnerability from cvelistv5 – Published: 2025-12-16 13:57 – Updated: 2026-08-05 12:10
VLAI
Title
ice: fix PTP cleanup on driver removal in error path
Summary
In the Linux kernel, the following vulnerability has been resolved: ice: fix PTP cleanup on driver removal in error path Improve the cleanup on releasing PTP resources in error path. The error case might happen either at the driver probe and PTP feature initialization or on PTP restart (errors in reset handling, NVM update etc). In both cases, calls to PF PTP cleanup (ice_ptp_cleanup_pf function) and 'ps_lock' mutex deinitialization were missed. Additionally, ptp clock was not unregistered in the latter case. Keep PTP state as 'uninitialized' on init to distinguish between error scenarios and to avoid resource release duplication at driver removal. The consequence of missing ice_ptp_cleanup_pf call is the following call trace dumped when ice_adapter object is freed (port list is not empty, as it is required at this stage): [ T93022] ------------[ cut here ]------------ [ T93022] WARNING: CPU: 10 PID: 93022 at ice/ice_adapter.c:67 ice_adapter_put+0xef/0x100 [ice] ... [ T93022] RIP: 0010:ice_adapter_put+0xef/0x100 [ice] ... [ T93022] Call Trace: [ T93022] <TASK> [ T93022] ? ice_adapter_put+0xef/0x100 [ice 33d2647ad4f6d866d41eefff1806df37c68aef0c] [ T93022] ? __warn.cold+0xb0/0x10e [ T93022] ? ice_adapter_put+0xef/0x100 [ice 33d2647ad4f6d866d41eefff1806df37c68aef0c] [ T93022] ? report_bug+0xd8/0x150 [ T93022] ? handle_bug+0xe9/0x110 [ T93022] ? exc_invalid_op+0x17/0x70 [ T93022] ? asm_exc_invalid_op+0x1a/0x20 [ T93022] ? ice_adapter_put+0xef/0x100 [ice 33d2647ad4f6d866d41eefff1806df37c68aef0c] [ T93022] pci_device_remove+0x42/0xb0 [ T93022] device_release_driver_internal+0x19f/0x200 [ T93022] driver_detach+0x48/0x90 [ T93022] bus_remove_driver+0x70/0xf0 [ T93022] pci_unregister_driver+0x42/0xb0 [ T93022] ice_module_exit+0x10/0xdb0 [ice 33d2647ad4f6d866d41eefff1806df37c68aef0c] ... [ T93022] ---[ end trace 0000000000000000 ]--- [ T93022] ice: module unloaded
Severity
7 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 2f59743be4d9568cad2d9cf697d1b897975421ed , < f5eb91f876ebecbcd90f9edcaea98dcb354603b3 (git)
Affected: e800654e85b5b27966fc6493201f5f8cf658beb6 , < 765236f2c4fbba7650436b71a0e350500e9ec15f (git)
Affected: e800654e85b5b27966fc6493201f5f8cf658beb6 , < 23a5b9b12de9dcd15ebae4f1abc8814ec1c51ab0 (git)
Affected: 6.12.11 , < 6.12.60 (semver)
Create a notification for this product.
Linux Linux Affected: 6.13
Unaffected: 0 , < 6.13 (semver)
Unaffected: 6.12.60 , ≤ 6.12.* (semver)
Unaffected: 6.17.10 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/ice/ice_ptp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f5eb91f876ebecbcd90f9edcaea98dcb354603b3",
              "status": "affected",
              "version": "2f59743be4d9568cad2d9cf697d1b897975421ed",
              "versionType": "git"
            },
            {
              "lessThan": "765236f2c4fbba7650436b71a0e350500e9ec15f",
              "status": "affected",
              "version": "e800654e85b5b27966fc6493201f5f8cf658beb6",
              "versionType": "git"
            },
            {
              "lessThan": "23a5b9b12de9dcd15ebae4f1abc8814ec1c51ab0",
              "status": "affected",
              "version": "e800654e85b5b27966fc6493201f5f8cf658beb6",
              "versionType": "git"
            },
            {
              "lessThan": "6.12.60",
              "status": "affected",
              "version": "6.12.11",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/ice/ice_ptp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.60",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.60",
                  "versionStartIncluding": "6.12.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.10",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: fix PTP cleanup on driver removal in error path\n\nImprove the cleanup on releasing PTP resources in error path.\nThe error case might happen either at the driver probe and PTP\nfeature initialization or on PTP restart (errors in reset handling, NVM\nupdate etc). In both cases, calls to PF PTP cleanup (ice_ptp_cleanup_pf\nfunction) and \u0027ps_lock\u0027 mutex deinitialization were missed.\nAdditionally, ptp clock was not unregistered in the latter case.\n\nKeep PTP state as \u0027uninitialized\u0027 on init to distinguish between error\nscenarios and to avoid resource release duplication at driver removal.\n\nThe consequence of missing ice_ptp_cleanup_pf call is the following call\ntrace dumped when ice_adapter object is freed (port list is not empty,\nas it is required at this stage):\n\n[  T93022] ------------[ cut here ]------------\n[  T93022] WARNING: CPU: 10 PID: 93022 at\nice/ice_adapter.c:67 ice_adapter_put+0xef/0x100 [ice]\n...\n[  T93022] RIP: 0010:ice_adapter_put+0xef/0x100 [ice]\n...\n[  T93022] Call Trace:\n[  T93022]  \u003cTASK\u003e\n[  T93022]  ? ice_adapter_put+0xef/0x100 [ice\n33d2647ad4f6d866d41eefff1806df37c68aef0c]\n[  T93022]  ? __warn.cold+0xb0/0x10e\n[  T93022]  ? ice_adapter_put+0xef/0x100 [ice\n33d2647ad4f6d866d41eefff1806df37c68aef0c]\n[  T93022]  ? report_bug+0xd8/0x150\n[  T93022]  ? handle_bug+0xe9/0x110\n[  T93022]  ? exc_invalid_op+0x17/0x70\n[  T93022]  ? asm_exc_invalid_op+0x1a/0x20\n[  T93022]  ? ice_adapter_put+0xef/0x100 [ice\n33d2647ad4f6d866d41eefff1806df37c68aef0c]\n[  T93022]  pci_device_remove+0x42/0xb0\n[  T93022]  device_release_driver_internal+0x19f/0x200\n[  T93022]  driver_detach+0x48/0x90\n[  T93022]  bus_remove_driver+0x70/0xf0\n[  T93022]  pci_unregister_driver+0x42/0xb0\n[  T93022]  ice_module_exit+0x10/0xdb0 [ice\n33d2647ad4f6d866d41eefff1806df37c68aef0c]\n...\n[  T93022] ---[ end trace 0000000000000000 ]---\n[  T93022] ice: module unloaded"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The strongest attacker-reachable path is local: after PTP restart failure and driver removal, the still-registered PTP character device invokes callbacks through a structure embedded in the freed PF. This is not directly reachable through received network packets.\nAC:H - Exploitation requires a PTP initialization or rebuild failure followed by driver teardown, conditions an unprivileged attacker generally cannot force. Once this state exists, the persistent dangling PTP interface is reliably callable without winning a race.\nPR:L - An ordinary local user with read access to the PTP device can invoke time and offset operations that lack capability checks. Initiating reset or removal requires host administration, but that need not be performed by the attacker.\nUI:N - No human victim action is intrinsically required because reset failure and removal can result from firmware events, PCI error recovery, hotplug, shutdown, or automated device management.\nS:U - Exploitation affects the host kernel within the same security authority; ordinary kernel privilege escalation does not constitute a scope change.\nC:H - The dangling ptp_clock_info and pin_config pointers can be reclaimed and manipulated, enabling stale-pointer dereferences and potentially arbitrary kernel-memory reads.\nI:H - Reclaiming the freed PF allocation can provide control over PTP callback pointers, making control-flow hijacking and arbitrary kernel-memory modification defensible impacts.\nA:H - The stale adapter-list node and PTP callbacks can cause use-after-free accesses, invalid indirect calls, kernel oopses, or panics; the observed WARN can also be fatal under panic-on-warn configurations."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:10:15.993Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f5eb91f876ebecbcd90f9edcaea98dcb354603b3"
        },
        {
          "url": "https://git.kernel.org/stable/c/765236f2c4fbba7650436b71a0e350500e9ec15f"
        },
        {
          "url": "https://git.kernel.org/stable/c/23a5b9b12de9dcd15ebae4f1abc8814ec1c51ab0"
        }
      ],
      "title": "ice: fix PTP cleanup on driver removal in error path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-68215",
    "datePublished": "2025-12-16T13:57:10.576Z",
    "dateReserved": "2025-12-16T13:41:40.256Z",
    "dateUpdated": "2026-08-05T12:10:15.993Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-68215",
      "date": "2026-08-14",
      "epss": "0.0014",
      "percentile": "0.03885"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-68215\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-16T14:15:54.490\",\"lastModified\":\"2026-07-30T06:24:33.697\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nice: fix PTP cleanup on driver removal in error path\\n\\nImprove the cleanup on releasing PTP resources in error path.\\nThe error case might happen either at the driver probe and PTP\\nfeature initialization or on PTP restart (errors in reset handling, NVM\\nupdate etc). In both cases, calls to PF PTP cleanup (ice_ptp_cleanup_pf\\nfunction) and \u0027ps_lock\u0027 mutex deinitialization were missed.\\nAdditionally, ptp clock was not unregistered in the latter case.\\n\\nKeep PTP state as \u0027uninitialized\u0027 on init to distinguish between error\\nscenarios and to avoid resource release duplication at driver removal.\\n\\nThe consequence of missing ice_ptp_cleanup_pf call is the following call\\ntrace dumped when ice_adapter object is freed (port list is not empty,\\nas it is required at this stage):\\n\\n[  T93022] ------------[ cut here ]------------\\n[  T93022] WARNING: CPU: 10 PID: 93022 at\\nice/ice_adapter.c:67 ice_adapter_put+0xef/0x100 [ice]\\n...\\n[  T93022] RIP: 0010:ice_adapter_put+0xef/0x100 [ice]\\n...\\n[  T93022] Call Trace:\\n[  T93022]  \u003cTASK\u003e\\n[  T93022]  ? ice_adapter_put+0xef/0x100 [ice\\n33d2647ad4f6d866d41eefff1806df37c68aef0c]\\n[  T93022]  ? __warn.cold+0xb0/0x10e\\n[  T93022]  ? ice_adapter_put+0xef/0x100 [ice\\n33d2647ad4f6d866d41eefff1806df37c68aef0c]\\n[  T93022]  ? report_bug+0xd8/0x150\\n[  T93022]  ? handle_bug+0xe9/0x110\\n[  T93022]  ? exc_invalid_op+0x17/0x70\\n[  T93022]  ? asm_exc_invalid_op+0x1a/0x20\\n[  T93022]  ? ice_adapter_put+0xef/0x100 [ice\\n33d2647ad4f6d866d41eefff1806df37c68aef0c]\\n[  T93022]  pci_device_remove+0x42/0xb0\\n[  T93022]  device_release_driver_internal+0x19f/0x200\\n[  T93022]  driver_detach+0x48/0x90\\n[  T93022]  bus_remove_driver+0x70/0xf0\\n[  T93022]  pci_unregister_driver+0x42/0xb0\\n[  T93022]  ice_module_exit+0x10/0xdb0 [ice\\n33d2647ad4f6d866d41eefff1806df37c68aef0c]\\n...\\n[  T93022] ---[ end trace 0000000000000000 ]---\\n[  T93022] ice: module unloaded\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/intel/ice/ice_ptp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2f59743be4d9568cad2d9cf697d1b897975421ed\",\"lessThan\":\"f5eb91f876ebecbcd90f9edcaea98dcb354603b3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e800654e85b5b27966fc6493201f5f8cf658beb6\",\"lessThan\":\"765236f2c4fbba7650436b71a0e350500e9ec15f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e800654e85b5b27966fc6493201f5f8cf658beb6\",\"lessThan\":\"23a5b9b12de9dcd15ebae4f1abc8814ec1c51ab0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.12.11\",\"lessThan\":\"6.12.60\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/intel/ice/ice_ptp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.13\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.13\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.60\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17.10\",\"lessThanOrEqual\":\"6.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.0,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/23a5b9b12de9dcd15ebae4f1abc8814ec1c51ab0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/765236f2c4fbba7650436b71a0e350500e9ec15f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f5eb91f876ebecbcd90f9edcaea98dcb354603b3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-07-30T08:10:22+00:00",
      "cve": "CVE-2025-68215",
      "id": "CVE-2025-68215",
      "initial_release_date": "2025-12-16T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ice: fix PTP cleanup on driver removal in error path",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-68215.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-31T00:58:52Z",
      "cve": "CVE-2025-68215",
      "id": "CVE-2025-68215",
      "initial_release_date": "2025-12-17T00:25:16Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "374",
      "product_status:recommended": "283",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-68215",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-68215.json",
      "version": "31"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.