# CVE-2025-38126: net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping

> A divide-by-zero error in the stmmac network driver causes a kernel crash when configuring timestamping with a zero PTP rate.

- **Severity:** Medium 5.5 (`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 3 Jul 2025
- **Updated:** 11 May 2026
- **Also known as:** AZL-64484, AZL-72722, BELL-CVE-2025-38126, DEBIAN-CVE-2025-38126, GHSA-7jmr-6pr9-g7cc, ROOT-OS-DEBIAN-11-CVE-2025-38126, ROOT-OS-DEBIAN-12-CVE-2025-38126, ROOT-OS-UBUNTU-2204-CVE-2025-38126, ROOT-OS-UBUNTU-2404-CVE-2025-38126, UBUNTU-CVE-2025-38126

## What is CVE-2025-38126?

CVE-2025-38126 is a medium-severity denial of service vulnerability in Debian Debian Linux, published on 3 Jul 2025. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping

The stmmac platform drivers that do not open-code the clk_ptp_rate value
after having retrieved the default one from the device-tree can end up
with 0 in clk_ptp_rate (as clk_get_rate can return 0). It will
eventually propagate up to PTP initialization when bringing up the
interface, leading to a divide by 0:

 Division by zero in kernel.
 CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.12.30-00001-g48313bd5768a #22
 Hardware name: STM32 (Device Tree Support)
 Call trace:
  unwind_backtrace from show_stack+0x18/0x1c
  show_stack from dump_stack_lvl+0x6c/0x8c
  dump_stack_lvl from Ldiv0_64+0x8/0x18
  Ldiv0_64 from stmmac_init_tstamp_counter+0x190/0x1a4
  stmmac_init_tstamp_counter from stmmac_hw_setup+0xc1c/0x111c
  stmmac_hw_setup from __stmmac_open+0x18c/0x434
  __stmmac_open from stmmac_open+0x3c/0xbc
  stmmac_open from __dev_open+0xf4/0x1ac
  __dev_open from __dev_change_flags+0x1cc/0x224
  __dev_change_flags from dev_change_flags+0x24/0x60
  dev_change_flags from ip_auto_config+0x2e8/0x11a0
  ip_auto_config from do_one_initcall+0x84/0x33c
  do_one_initcall from kernel_init_freeable+0x1b8/0x214
  kernel_init_freeable from kernel_init+0x24/0x140
  kernel_init from ret_from_fork+0x14/0x28
 Exception stack(0xe0815fb0 to 0xe0815ff8)

Prevent this division by 0 by adding an explicit check and error log
about the actual issue. While at it, remove the same check from
stmmac_ptp_register, which then becomes duplicate

Weakness: CWE-369 (Divide By Zero)

## Which versions are affected by CVE-2025-38126?

It affects 2 products.


Products: Debian Debian Linux, Linux kernel.

## How do I fix CVE-2025-38126?

Apply the vendor's patch.

## Is CVE-2025-38126 being exploited?

There is no known exploitation of CVE-2025-38126 in the wild and no public exploit code.

## Other vulnerabilities in Debian Debian Linux

- [CVE-2015-3306](https://insights.sbomify.com/CVE-2015-3306/): ProFTPD Improper Access Control (critical 10.0, exploited in the wild)
- [CVE-2025-49113](https://insights.sbomify.com/CVE-2025-49113/): RoundCube Webmail Deserialization of Untrusted Data (critical 9.9, exploited in the wild)
- [CVE-2026-24061](https://insights.sbomify.com/CVE-2026-24061/): GNU InetUtils Argument Injection (critical 9.8, exploited in the wild)
- [CVE-2025-39682](https://insights.sbomify.com/CVE-2025-39682/): Linux Kernel Improper Check for Unusual or Exceptional Conditions (critical 9.8, exploited in the wild)
- [CVE-2024-9680](https://insights.sbomify.com/CVE-2024-9680/): Mozilla Firefox Use-After-Free (critical 9.8, exploited in the wild)

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2025-38126 and fix it if it is affected.

What it is: CVE-2025-38126 is a medium-severity denial of service vulnerability in Debian Debian Linux, published on 3 Jul 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2025-38126 in the wild and no public exploit code.

Affected product: Debian Debian Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2025-38126/ (Markdown: https://insights.sbomify.com/CVE-2025-38126/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2025-38126
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-38126
- OSV: https://osv.dev/vulnerability/CVE-2025-38126

---
From sbomify Insights: https://insights.sbomify.com/CVE-2025-38126/
Summaries are generated and may contain mistakes; the official description above is the record.