Skip to main content

Linux Kernel CVE-2025-68215

HIGH
2025-12-16 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
7.0
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.0 HIGH
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
1.9 LOW

Local, privileged driver management (PR:H) and a hard-to-hit error path (AC:H); impact is a WARNING and resource leak, so availability-only (A:L), no confidentiality or integrity effect.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L
4.0 AV:L/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 HIGH
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 07:22 vuln.today
CVE Published
Dec 16, 2025 - 14:15 cve.org
HIGH 7.0

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ice: fix PTP cleanup on driver removal in error path

Improve the cleanup on releasing PTP resources in error path. The error case might happen either at the driver probe and PTP feature initialization or on PTP restart (errors in reset handling, NVM update etc). In both cases, calls to PF PTP cleanup (ice_ptp_cleanup_pf function) and 'ps_lock' mutex deinitialization were missed. Additionally, ptp clock was not unregistered in the latter case.

Keep PTP state as 'uninitialized' on init to distinguish between error scenarios and to avoid resource release duplication at driver removal.

The consequence of missing ice_ptp_cleanup_pf call is the following call trace dumped when ice_adapter object is freed (port list is not empty, as it is required at this stage):

[ T93022] ------------[ cut here ]------------ [ T93022] WARNING: CPU: 10 PID: 93022 at ice/ice_adapter.c:67 ice_adapter_put+0xef/0x100 [ice] ... [ T93022] RIP: 0010:ice_adapter_put+0xef/0x100 [ice] ... [ T93022] Call Trace: [ T93022] <TASK> [ T93022] ? ice_adapter_put+0xef/0x100 [ice 33d2647ad4f6d866d41eefff1806df37c68aef0c] [ T93022] ? __warn.cold+0xb0/0x10e [ T93022] ? ice_adapter_put+0xef/0x100 [ice 33d2647ad4f6d866d41eefff1806df37c68aef0c] [ T93022] ? report_bug+0xd8/0x150 [ T93022] ? handle_bug+0xe9/0x110 [ T93022] ? exc_invalid_op+0x17/0x70 [ T93022] ? asm_exc_invalid_op+0x1a/0x20 [ T93022] ? ice_adapter_put+0xef/0x100 [ice 33d2647ad4f6d866d41eefff1806df37c68aef0c] [ T93022] pci_device_remove+0x42/0xb0 [ T93022] device_release_driver_internal+0x19f/0x200 [ T93022] driver_detach+0x48/0x90 [ T93022] bus_remove_driver+0x70/0xf0 [ T93022] pci_unregister_driver+0x42/0xb0 [ T93022] ice_module_exit+0x10/0xdb0 [ice 33d2647ad4f6d866d41eefff1806df37c68aef0c] ... [ T93022] ---[ end trace 0000000000000000 ]--- [ T93022] ice: module unloaded

AnalysisAI

Improper resource cleanup in the Linux kernel's Intel ice Ethernet driver leaves PTP (Precision Time Protocol) resources leaked when driver probe, PTP initialization, or PTP restart hits an error path. On subsequent driver removal the leaked PF PTP state and un-deinitialized 'ps_lock' mutex trigger a kernel WARNING in ice_adapter_put, and the PTP clock is left registered. No public exploit identified at time of analysis, EPSS is low (0.17%, 7th percentile), and there is no CISA KEV listing; this is a robustness/error-handling defect requiring local privileged access to the NIC driver.

Technical ContextAI

The affected component is the ice driver, which supports Intel E800-series (E810) Ethernet controllers and implements hardware PTP/PHC timestamping. During driver bring-up the code registers a PTP clock, allocates PF-level PTP context, and initializes a 'ps_lock' mutex to serialize PTP state. When an error occurs during probe/PTP init or during a PTP restart (reset handling, NVM update, etc.), the fix path failed to call ice_ptp_cleanup_pf, failed to destroy 'ps_lock', and in the restart case never unregistered the PTP clock. The patch introduces an 'uninitialized' PTP state to distinguish error scenarios from normal teardown and prevent double-free/duplicate release at removal. No CWE was assigned by NVD, but the root cause class is improper cleanup/resource release on an error path (CWE-459-style incomplete cleanup / missing release of resource), not the 'Information Disclosure' implied by the input tags.

Affected ProductsAI

The vulnerability is in the mainline/stable Linux kernel ice driver (Intel E800/E810-series Ethernet). NVD provides no CPE ranges and no tagged release boundaries in the supplied data; the fix is delivered through three stable-tree commits (git.kernel.org commits 23a5b9b12de9dcd15ebae4f1abc8814ec1c51ab0, 765236f2c4fbba7650436b71a0e350500e9ec15f, and f5eb91f876ebecbcd90f9edcaea98dcb354603b3), indicating multiple stable branches were patched. Exact vulnerable version ranges are not specified in the input and should be derived from the affected/fixed tags in each stable commit.

RemediationAI

Upstream fix available (commits, not a named tagged release); released patched version not independently confirmed from the input - apply the stable-tree commits 23a5b9b12de9dcd15ebae4f1abc8814ec1c51ab0, 765236f2c4fbba7650436b71a0e350500e9ec15f, and f5eb91f876ebecbcd90f9edcaea98dcb354603b3 (git.kernel.org) by updating to the corresponding fixed stable kernel for your branch. Since exploitation requires local privileged manipulation of the ice driver and the impact is a cleanup WARNING/resource leak rather than remote compromise, it is safe to schedule this in a normal maintenance window. As a compensating control until patching, avoid repeated ice driver load/unload cycles and NVM updates on affected hosts and restrict driver/module management to trusted administrators (CAP_SYS_MODULE / root), accepting that this only reduces trigger frequency and does not remove the defect. Confirm the fixed version from your distribution's kernel changelog before deployment.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/kvm-os-container:latest Container suse/sl-micro/6.0/rt-os-container:latest Image SL-Micro Affected
Container suse/sl-micro/6.0/toolbox:latest Affected
Image SLES-Azure-3P Image SLES-Azure-Basic Image SLES-Azure-Standard Image SLES-BYOS-Azure Image SLES-BYOS-EC2 Image SLES-BYOS-GCE Image SLES-CHOST-BYOS-Aliyun Image SLES-CHOST-BYOS-Azure Image SLES-CHOST-BYOS-EC2 Image SLES-CHOST-BYOS-GCE Image SLES-CHOST-BYOS-GDC Image SLES-CHOST-BYOS-SAP-CCloud Image SLES-EC2 Image SLES-EC2-ECS Image SLES-GCE Image SLES-GCE-3P Image SLES-Hardened-BYOS-Azure Image SLES-Hardened-BYOS-EC2 Image SLES-Hardened-BYOS-GCE Image SLES-SAPCAL-Azure Image SLES-SAPCAL-EC2 Image SLES-SAPCAL-GCE Affected
Image SLES-SAP-Azure Image SLES-SAP-Azure-3P Image SLES-SAP-BYOS-Azure Image SLES-SAP-BYOS-EC2 Image SLES-SAP-BYOS-GCE Image SLES-SAP-EC2 Image SLES-SAP-GCE Image SLES-SAP-GCE-3P Affected
Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-HPC-Azure Affected

Share

CVE-2025-68215 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy