CVE-2025-40175 idpf: cleanup remaining SKBs in PTP flows
A memory leak in the Linux kernel idpf driver allows attackers to cause denial of service by triggering PTP timestamp flows that fail to release SKBs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-40175?
CVE-2025-40175 is a memory corruption vulnerability in Linux, published on 12 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
idpf: cleanup remaining SKBs in PTP flows
When the driver requests Tx timestamp value, one of the first steps is to clone SKB using skb_get. It increases the reference counter for that SKB to prevent unexpected freeing by another component. However, there may be a case where the index is requested, SKB is assigned and never consumed by PTP flows - for example due to reset during running PTP apps.
Add a check in release timestamping function to verify if the SKB assigned to Tx timestamp latch was freed, and release remaining SKBs.
Which versions are affected by CVE-2025-40175?
How do I fix CVE-2025-40175?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-40175 being exploited?
There is no known exploitation of CVE-2025-40175 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2025-40175, DEBIAN-CVE-2025-40175, GHSA-q7g3-3qc3-3427, UBUNTU-CVE-2025-40175.