CVE-2025-68215 (GCVE-0-2025-68215)

Vulnerability from cvelistv5 – Published: 2025-12-16 13:57 – Updated: 2025-12-16 13:57
VLAI?
Title
ice: fix PTP cleanup on driver removal in error path
Summary
In the Linux kernel, the following vulnerability has been resolved: ice: fix PTP cleanup on driver removal in error path Improve the cleanup on releasing PTP resources in error path. The error case might happen either at the driver probe and PTP feature initialization or on PTP restart (errors in reset handling, NVM update etc). In both cases, calls to PF PTP cleanup (ice_ptp_cleanup_pf function) and 'ps_lock' mutex deinitialization were missed. Additionally, ptp clock was not unregistered in the latter case. Keep PTP state as 'uninitialized' on init to distinguish between error scenarios and to avoid resource release duplication at driver removal. The consequence of missing ice_ptp_cleanup_pf call is the following call trace dumped when ice_adapter object is freed (port list is not empty, as it is required at this stage): [ T93022] ------------[ cut here ]------------ [ T93022] WARNING: CPU: 10 PID: 93022 at ice/ice_adapter.c:67 ice_adapter_put+0xef/0x100 [ice] ... [ T93022] RIP: 0010:ice_adapter_put+0xef/0x100 [ice] ... [ T93022] Call Trace: [ T93022] <TASK> [ T93022] ? ice_adapter_put+0xef/0x100 [ice 33d2647ad4f6d866d41eefff1806df37c68aef0c] [ T93022] ? __warn.cold+0xb0/0x10e [ T93022] ? ice_adapter_put+0xef/0x100 [ice 33d2647ad4f6d866d41eefff1806df37c68aef0c] [ T93022] ? report_bug+0xd8/0x150 [ T93022] ? handle_bug+0xe9/0x110 [ T93022] ? exc_invalid_op+0x17/0x70 [ T93022] ? asm_exc_invalid_op+0x1a/0x20 [ T93022] ? ice_adapter_put+0xef/0x100 [ice 33d2647ad4f6d866d41eefff1806df37c68aef0c] [ T93022] pci_device_remove+0x42/0xb0 [ T93022] device_release_driver_internal+0x19f/0x200 [ T93022] driver_detach+0x48/0x90 [ T93022] bus_remove_driver+0x70/0xf0 [ T93022] pci_unregister_driver+0x42/0xb0 [ T93022] ice_module_exit+0x10/0xdb0 [ice 33d2647ad4f6d866d41eefff1806df37c68aef0c] ... [ T93022] ---[ end trace 0000000000000000 ]--- [ T93022] ice: module unloaded
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 2f59743be4d9568cad2d9cf697d1b897975421ed , < f5eb91f876ebecbcd90f9edcaea98dcb354603b3 (git)
Affected: e800654e85b5b27966fc6493201f5f8cf658beb6 , < 765236f2c4fbba7650436b71a0e350500e9ec15f (git)
Affected: e800654e85b5b27966fc6493201f5f8cf658beb6 , < 23a5b9b12de9dcd15ebae4f1abc8814ec1c51ab0 (git)
Create a notification for this product.
    Linux Linux Affected: 6.13
Unaffected: 0 , < 6.13 (semver)
Unaffected: 6.12.60 , ≤ 6.12.* (semver)
Unaffected: 6.17.10 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/ice/ice_ptp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f5eb91f876ebecbcd90f9edcaea98dcb354603b3",
              "status": "affected",
              "version": "2f59743be4d9568cad2d9cf697d1b897975421ed",
              "versionType": "git"
            },
            {
              "lessThan": "765236f2c4fbba7650436b71a0e350500e9ec15f",
              "status": "affected",
              "version": "e800654e85b5b27966fc6493201f5f8cf658beb6",
              "versionType": "git"
            },
            {
              "lessThan": "23a5b9b12de9dcd15ebae4f1abc8814ec1c51ab0",
              "status": "affected",
              "version": "e800654e85b5b27966fc6493201f5f8cf658beb6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/ice/ice_ptp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.60",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.60",
                  "versionStartIncluding": "6.12.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.10",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: fix PTP cleanup on driver removal in error path\n\nImprove the cleanup on releasing PTP resources in error path.\nThe error case might happen either at the driver probe and PTP\nfeature initialization or on PTP restart (errors in reset handling, NVM\nupdate etc). In both cases, calls to PF PTP cleanup (ice_ptp_cleanup_pf\nfunction) and \u0027ps_lock\u0027 mutex deinitialization were missed.\nAdditionally, ptp clock was not unregistered in the latter case.\n\nKeep PTP state as \u0027uninitialized\u0027 on init to distinguish between error\nscenarios and to avoid resource release duplication at driver removal.\n\nThe consequence of missing ice_ptp_cleanup_pf call is the following call\ntrace dumped when ice_adapter object is freed (port list is not empty,\nas it is required at this stage):\n\n[  T93022] ------------[ cut here ]------------\n[  T93022] WARNING: CPU: 10 PID: 93022 at\nice/ice_adapter.c:67 ice_adapter_put+0xef/0x100 [ice]\n...\n[  T93022] RIP: 0010:ice_adapter_put+0xef/0x100 [ice]\n...\n[  T93022] Call Trace:\n[  T93022]  \u003cTASK\u003e\n[  T93022]  ? ice_adapter_put+0xef/0x100 [ice\n33d2647ad4f6d866d41eefff1806df37c68aef0c]\n[  T93022]  ? __warn.cold+0xb0/0x10e\n[  T93022]  ? ice_adapter_put+0xef/0x100 [ice\n33d2647ad4f6d866d41eefff1806df37c68aef0c]\n[  T93022]  ? report_bug+0xd8/0x150\n[  T93022]  ? handle_bug+0xe9/0x110\n[  T93022]  ? exc_invalid_op+0x17/0x70\n[  T93022]  ? asm_exc_invalid_op+0x1a/0x20\n[  T93022]  ? ice_adapter_put+0xef/0x100 [ice\n33d2647ad4f6d866d41eefff1806df37c68aef0c]\n[  T93022]  pci_device_remove+0x42/0xb0\n[  T93022]  device_release_driver_internal+0x19f/0x200\n[  T93022]  driver_detach+0x48/0x90\n[  T93022]  bus_remove_driver+0x70/0xf0\n[  T93022]  pci_unregister_driver+0x42/0xb0\n[  T93022]  ice_module_exit+0x10/0xdb0 [ice\n33d2647ad4f6d866d41eefff1806df37c68aef0c]\n...\n[  T93022] ---[ end trace 0000000000000000 ]---\n[  T93022] ice: module unloaded"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-16T13:57:10.576Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f5eb91f876ebecbcd90f9edcaea98dcb354603b3"
        },
        {
          "url": "https://git.kernel.org/stable/c/765236f2c4fbba7650436b71a0e350500e9ec15f"
        },
        {
          "url": "https://git.kernel.org/stable/c/23a5b9b12de9dcd15ebae4f1abc8814ec1c51ab0"
        }
      ],
      "title": "ice: fix PTP cleanup on driver removal in error path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-68215",
    "datePublished": "2025-12-16T13:57:10.576Z",
    "dateReserved": "2025-12-16T13:41:40.256Z",
    "dateUpdated": "2025-12-16T13:57:10.576Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-68215\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-16T14:15:54.490\",\"lastModified\":\"2025-12-18T15:08:06.237\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nice: fix PTP cleanup on driver removal in error path\\n\\nImprove the cleanup on releasing PTP resources in error path.\\nThe error case might happen either at the driver probe and PTP\\nfeature initialization or on PTP restart (errors in reset handling, NVM\\nupdate etc). In both cases, calls to PF PTP cleanup (ice_ptp_cleanup_pf\\nfunction) and \u0027ps_lock\u0027 mutex deinitialization were missed.\\nAdditionally, ptp clock was not unregistered in the latter case.\\n\\nKeep PTP state as \u0027uninitialized\u0027 on init to distinguish between error\\nscenarios and to avoid resource release duplication at driver removal.\\n\\nThe consequence of missing ice_ptp_cleanup_pf call is the following call\\ntrace dumped when ice_adapter object is freed (port list is not empty,\\nas it is required at this stage):\\n\\n[  T93022] ------------[ cut here ]------------\\n[  T93022] WARNING: CPU: 10 PID: 93022 at\\nice/ice_adapter.c:67 ice_adapter_put+0xef/0x100 [ice]\\n...\\n[  T93022] RIP: 0010:ice_adapter_put+0xef/0x100 [ice]\\n...\\n[  T93022] Call Trace:\\n[  T93022]  \u003cTASK\u003e\\n[  T93022]  ? ice_adapter_put+0xef/0x100 [ice\\n33d2647ad4f6d866d41eefff1806df37c68aef0c]\\n[  T93022]  ? __warn.cold+0xb0/0x10e\\n[  T93022]  ? ice_adapter_put+0xef/0x100 [ice\\n33d2647ad4f6d866d41eefff1806df37c68aef0c]\\n[  T93022]  ? report_bug+0xd8/0x150\\n[  T93022]  ? handle_bug+0xe9/0x110\\n[  T93022]  ? exc_invalid_op+0x17/0x70\\n[  T93022]  ? asm_exc_invalid_op+0x1a/0x20\\n[  T93022]  ? ice_adapter_put+0xef/0x100 [ice\\n33d2647ad4f6d866d41eefff1806df37c68aef0c]\\n[  T93022]  pci_device_remove+0x42/0xb0\\n[  T93022]  device_release_driver_internal+0x19f/0x200\\n[  T93022]  driver_detach+0x48/0x90\\n[  T93022]  bus_remove_driver+0x70/0xf0\\n[  T93022]  pci_unregister_driver+0x42/0xb0\\n[  T93022]  ice_module_exit+0x10/0xdb0 [ice\\n33d2647ad4f6d866d41eefff1806df37c68aef0c]\\n...\\n[  T93022] ---[ end trace 0000000000000000 ]---\\n[  T93022] ice: module unloaded\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/23a5b9b12de9dcd15ebae4f1abc8814ec1c51ab0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/765236f2c4fbba7650436b71a0e350500e9ec15f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f5eb91f876ebecbcd90f9edcaea98dcb354603b3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.