CVE-2025-21924 net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an error
A resource leak in the Linux kernel hns3 driver occurs when PTP initialization fails, potentially leading to memory exhaustion and denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-21924?
CVE-2025-21924 is a high-severity vulnerability in Linux kernel, published on 1 Apr 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an error
During the initialization of ptp, hclge_ptp_get_cycle might return an error and returned directly without unregister clock and free it. To avoid that, call hclge_ptp_destroy_clock to unregist and free clock if hclge_ptp_get_cycle failed.
Weakness: CWE-459
Which versions are affected by CVE-2025-21924?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-21924?
Apply the vendor's patch.
Is CVE-2025-21924 being exploited?
There is no known exploitation of CVE-2025-21924 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2025-21924, DEBIAN-CVE-2025-21924, GHSA-8j66-r7fp-95mx, ROOT-OS-UBUNTU-2404-CVE-2025-21924, UBUNTU-CVE-2025-21924.