CVE-2025-38054 ptp: ocp: Limit signal/freq counts in summary output functions
A local attacker can trigger a kernel Oops via uninitialized array access in the PTP OCP driver's debugfs output, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-38054?
CVE-2025-38054 is a medium-severity vulnerability in Linux kernel, published on 18 Jun 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ptp: ocp: Limit signal/freq counts in summary output functions
The debugfs summary output could access uninitialized elements in the freq_in[] and signal_out[] arrays, causing NULL pointer dereferences and triggering a kernel Oops (page_fault_oops). This patch adds u8 fields (nr_freq_in, nr_signal_out) to track the number of initialized elements, with a maximum of 4 per array. The summary output functions are updated to respect these limits, preventing out-of-bounds access and ensuring safe array handling.
Widen the label variables because the change confuses GCC about max length of the strings.
Weakness: CWE-908
Which versions are affected by CVE-2025-38054?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-38054?
Apply the vendor's patch.
Is CVE-2025-38054 being exploited?
There is no known exploitation of CVE-2025-38054 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2025-38054, DEBIAN-CVE-2025-38054, GHSA-5x4q-vfjh-6h4j, UBUNTU-CVE-2025-38054.