CVE-2025-38305 ptp: remove ptp->n_vclocks check logic in ptp_vclock_in_use()
A recursive locking bug in the Linux kernel PTP subsystem can cause a deadlock, leading to a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-38305?
CVE-2025-38305 is a medium-severity vulnerability in Debian Debian Linux, published on 10 Jul 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ptp: remove ptp->n_vclocks check logic in ptp_vclock_in_use()
There is no disagreement that we should check both ptp->is_virtual_clock and ptp->n_vclocks to check if the ptp virtual clock is in use.
However, when we acquire ptp->n_vclocks_mux to read ptp->n_vclocks in ptp_vclock_in_use(), we observe a recursive lock in the call trace starting from n_vclocks_store().
============================================ WARNING: possible recursive locking detected 6.15.0-rc6 #1 Not tainted -------------------------------------------- syz.0.1540/13807 is trying to acquire lock: ffff888035a24868 (&ptp->n_vclocks_mux){+.+.}-{4:4}, at: ptp_vclock_in_use drivers/ptp/ptp_private.h:103 [inline] ffff888035a24868 (&ptp->n_vclocks_mux){+.+.}-{4:4}, at: ptp_clock_unregister+0x21/0x250 drivers/ptp/ptp_clock.c:415
but task is already holding lock: ffff888030704868 (&ptp->n_vclocks_mux){+.+.}-{4:4}, at: n_vclocks_store+0xf1/0x6d0 drivers/ptp/ptp_sysfs.c:215
other info that might help us debug this: Possible unsafe locking scenario:
CPU0 ---- lock(&ptp->n_vclocks_mux); lock(&ptp->n_vclocks_mux);
*** DEADLOCK *** .... ============================================
The best way to solve this is to remove the logic that checks ptp->n_vclocks in ptp_vclock_in_use().
The reason why this is appropriate is that any path that uses ptp->n_vclocks must unconditionally check if ptp->n_vclocks is greater than 0 before unregistering vclocks, and all functions are already written this way. And in the function that uses ptp->n_vclocks, we already get ptp->n_vclocks_mux before unregistering vclocks.
Therefore, we need to remove the redundant check for ptp->n_vclocks in ptp_vclock_in_use() to prevent recursive locking.
Which versions are affected by CVE-2025-38305?
It affects 2 products.
Products include Debian Debian Linux, Linux kernel.
How do I fix CVE-2025-38305?
Apply the vendor's patch.
Is CVE-2025-38305 being exploited?
There is no known exploitation of CVE-2025-38305 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as AZL-64961, BELL-CVE-2025-38305, DEBIAN-CVE-2025-38305, GHSA-vx82-qc8j-62qx, ROOT-OS-DEBIAN-12-CVE-2025-38305, ROOT-OS-UBUNTU-2204-CVE-2025-38305 and 2 more.