{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2025-68215 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2025-68215 is a high-severity use after free vulnerability in Linux, published on 16 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2025-68215 and fix it if it is affected.\n\nWhat it is: CVE-2025-68215 is a high-severity use after free vulnerability in Linux, published on 16 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2025-68215 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-68215/ (Markdown: https://insights.sbomify.com/CVE-2025-68215/index.md)","id":"CVE-2025-68215","markdown":"https://insights.sbomify.com/CVE-2025-68215/index.md","name":"CVE-2025-68215","record":{"aliases":["BELL-CVE-2025-68215","DEBIAN-CVE-2025-68215","GHSA-xq58-x87q-vfg7","ROOT-OS-DEBIAN-13-CVE-2025-68215","UBUNTU-CVE-2025-68215"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel driver","requires_auth":"low_privilege","summary":"A missing cleanup in the Linux kernel ice driver error path causes a use-after-free condition, leading to a system crash or warning during driver removal.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":7,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nice: fix PTP cleanup on driver removal in error path\n\nImprove the cleanup on releasing PTP resources in error path.\nThe error case might happen either at the driver probe and PTP\nfeature initialization or on PTP restart (errors in reset handling, NVM\nupdate etc). In both cases, calls to PF PTP cleanup (ice_ptp_cleanup_pf\nfunction) and 'ps_lock' mutex deinitialization were missed.\nAdditionally, ptp clock was not unregistered in the latter case.\n\nKeep PTP state as 'uninitialized' on init to distinguish between error\nscenarios and to avoid resource release duplication at driver removal.\n\nThe consequence of missing ice_ptp_cleanup_pf call is the following call\ntrace dumped when ice_adapter object is freed (port list is not empty,\nas it is required at this stage):\n\n[  T93022] ------------[ cut here ]------------\n[  T93022] WARNING: CPU: 10 PID: 93022 at\nice/ice_adapter.c:67 ice_adapter_put+0xef/0x100 [ice]\n...\n[  T93022] RIP: 0010:ice_adapter_put+0xef/0x100 [ice]\n...\n[  T93022] Call Trace:\n[  T93022]  \u003cTASK\u003e\n[  T93022]  ? ice_adapter_put+0xef/0x100 [ice\n33d2647ad4f6d866d41eefff1806df37c68aef0c]\n[  T93022]  ? __warn.cold+0xb0/0x10e\n[  T93022]  ? ice_adapter_put+0xef/0x100 [ice\n33d2647ad4f6d866d41eefff1806df37c68aef0c]\n[  T93022]  ? report_bug+0xd8/0x150\n[  T93022]  ? handle_bug+0xe9/0x110\n[  T93022]  ? exc_invalid_op+0x17/0x70\n[  T93022]  ? asm_exc_invalid_op+0x1a/0x20\n[  T93022]  ? ice_adapter_put+0xef/0x100 [ice\n33d2647ad4f6d866d41eefff1806df37c68aef0c]\n[  T93022]  pci_device_remove+0x42/0xb0\n[  T93022]  device_release_driver_internal+0x19f/0x200\n[  T93022]  driver_detach+0x48/0x90\n[  T93022]  bus_remove_driver+0x70/0xf0\n[  T93022]  pci_unregister_driver+0x42/0xb0\n[  T93022]  ice_module_exit+0x10/0xdb0 [ice\n33d2647ad4f6d866d41eefff1806df37c68aef0c]\n...\n[  T93022] ---[ end trace 0000000000000000 ]---\n[  T93022] ice: module unloaded","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"ice: fix PTP cleanup on driver removal in error path","id":"CVE-2025-68215","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"use_after_free","year":"2025"},"n_packages":0,"n_references":3,"next":{"headline":"LoongArch: BPF: Disable trampoline for kernel module function trace","id":"CVE-2025-68216"},"packages":[],"prev":{"headline":"timers: Fix NULL function pointer race in timer_shutdown_sync()","id":"CVE-2025-68214"},"products":["Linux"],"published":"2025-12-16","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-10-15","vendors":["Linux"]},"summary":"A missing cleanup in the Linux kernel ice driver error path causes a use-after-free condition, leading to a system crash or warning during driver removal.","url":"https://insights.sbomify.com/CVE-2025-68215/"}