CVE-2025-40255

by Fred · 04/12/2025

In the Linux kernel, the following vulnerability has been resolved:

net: core: prevent NULL deref in generic_hwtstamp_ioctl_lower()

The ethtool tsconfig Netlink path can trigger a null pointer
dereference. A call chain such as:

tsconfig_prepare_data() ->
dev_get_hwtstamp_phylib() ->
vlan_hwtstamp_get() ->
generic_hwtstamp_get_lower() ->
generic_hwtstamp_ioctl_lower()

results in generic_hwtstamp_ioctl_lower() being called with
kernel_cfg->ifr as NULL.

The generic_hwtstamp_ioctl_lower() function does not expect
a NULL ifr and dereferences it, leading to a system crash.

Fix this by adding a NULL check for kernel_cfg->ifr in
generic_hwtstamp_ioctl_lower(). If ifr is NULL, return -EINVAL.