Executive brief
A vulnerability was identified in the Linux kernel's networking component that could lead to system instability or unauthorized access. The issue occurs when the system handles hardware timestamping requests for network devices without proper synchronization locks. This could allow a local user to trigger a system crash or potentially gain elevated privileges by exploiting race conditions during network configuration.
Technical details
A race condition exists in the Linux kernel's net/core/dev_ioctl.c due to missing locking primitives. Specifically, the ndo_hwtstamp_get and ndo_hwtstamp_set callbacks were invoked without holding the per-device ops lock (netdev_lock_ops). This inconsistency with other ndo invocations can trigger kernel warnings in __netdev_update_features and lead to undefined behavior or system crashes. The vulnerability is reachable via local ioctl calls (SIOCGHWTSTAMP/SIOCSHWTSTAMP) on network sockets. The fix involves wrapping the phylib get/set paths with netdev_lock_ops and netdev_unlock_ops to ensure thread safety.
Affected products
- Linux Linux Kernel 6.15 to 6.16.8
Timeline
- 2025-09-07: patched: Initial patch authored by Carolina Jubran
- 2025-10-01: disclosed: CVE-2025-39908 published