CVE-2025-38126
NoneCVSS
—
EPSS
0.2%
Published
Jul 3, 2025
CISA due date
—
Cloudanix analysis
A Linux network driver bug can crash certain computers when they try to start their network connection.
- Exploitation
- Local Privilege
- Attacker needs
- Low Privilege
- Complexity
- Low
- Impact
- Denial Of Service
- Component
- OS kernel
- Class
- Improper Input Validation
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Missing validation of clk_ptp_rate allows a zero value from clk_get_rate to propagate into stmmac_init_tstamp_counter, triggering an integer divide-by-zero during PTP timestamp initialization on interface open.
Why it matters to the business
Affected Linux systems using stmmac Ethernet controllers may experience kernel crashes or boot failures when network interfaces are brought up, leading to service disruption on embedded or server platforms with high ecosystem prevalence.
How an attack unfolds
No remote attacker action is required; the flaw triggers automatically during normal interface initialization (ip_auto_config or equivalent) on hardware where device-tree-derived PTP clock rate is zero, as seen in certain STM32 and similar platforms.
How to fix it
Upgrade the Linux kernel to a version containing commit 32af9c289234990752281c805500dfe03c5b2b8f (or equivalent stable backports). Verify device-tree PTP clock entries are non-zero before enabling timestamping.
How to confirm the fix worked
Confirm kernel version includes the fix commit, then attempt interface bring-up on affected hardware while monitoring for absence of divide-by-zero in stmmac_init_tstamp_counter; inspect dmesg for the added error log on zero rate.
Typical attack path
- Boot or hot-plug triggers stmmac platform driver load
- clk_ptp_rate resolves to zero from device tree
- stmmac_open calls __stmmac_open then stmmac_hw_setup
- stmmac_init_tstamp_counter performs divide by zero
- Kernel panics with Ldiv0_64
How to detect it
Search kernel logs and crash dumps for Ldiv0_64 and stmmac_init_tstamp_counter stack traces; correlate with interface initialization events on stmmac hardware.
What your security team should do
- Prioritize kernel updates on all stmmac-based systems within standard patch windows given low EPSS and non-KEV status
- Audit device-tree files for clk_ptp_rate definitions across embedded deployments
- Add kernel panic and stmmac-related log monitoring to existing SIEM rules
The record
In the Linux kernel, the following vulnerability has been resolved: net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping The stmmac platform drivers that do not open-code the clk_ptp_rate value after having retrieved the default one from the device-tree can end up with 0 in clk_ptp_rate (as clk_get_rate can return 0). It will eventually propagate up to PTP initialization when bringing up the interface, leading to a divide by 0: Division by zero in kernel. CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.12.30-00001-g48313bd5768a #22 Hardware name: STM32 (Device Tree Support) Call trace: unwind_backtrace from show_stack+0x18/0x1c show_stack from dump_stack_lvl+0x6c/0x8c dump_stack_lvl from Ldiv0_64+0x8/0x18 Ldiv0_64 from stmmac_init_tstamp_counter+0x190/0x1a4 stmmac_init_tstamp_counter from stmmac_hw_setup+0xc1c/0x111c stmmac_hw_setup from __stmmac_open+0x18c/0x434 __stmmac_open from stmmac_open+0x3c/0xbc stmmac_open from __dev_open+0xf4/0x1ac __dev_open from __dev_change_flags+0x1cc/0x224 __dev_change_flags from dev_change_flags+0x24/0x60 dev_change_flags from ip_auto_config+0x2e8/0x11a0 ip_auto_config from do_one_initcall+0x84/0x33c do_one_initcall from kernel_init_freeable+0x1b8/0x214 kernel_init_freeable from kernel_init+0x24/0x140 kernel_init from ret_from_fork+0x14/0x28 Exception stack(0xe0815fb0 to 0xe0815ff8) Prevent this division by 0 by adding an explicit check and error log about the actual issue. While at it, remove the same check from stmmac_ptp_register, which then becomes duplicate
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | linux | 0 | No fix |
| Debian:12 | linux | 0 | No fix |
| Debian:13 | linux | 0 | No fix |
| Debian:14 | linux | 0 | 6.12.35-1 |
| Linux | Kernel | 4.5.0 | 6.1.142 |
| Mageia:9 | kernel | 0 | 6.6.101-1.mga9 |
| Mageia:9 | kernel-linus | 0 | 6.6.101-1.mga9 |
| Mageia:9 | kmod-virtualbox | 0 | 7.1.10-7.mga9 |
| Mageia:9 | kmod-xtables-addons | 0 | 3.24-83.mga9 |
| Mageia:9 | wireless-regdb | 0 | 20250710-1.mga9 |
| SUSE:Linux Enterprise High Availability Extension 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.65.1 |
| SUSE:Linux Enterprise Live Patching 12 SP5 | kernel-default | 0 | 4.12.14-122.269.1 |
| SUSE:Linux Enterprise Live Patching 12 SP5 | kgraft-patch-SLE12-SP5_Update_71 | 0 | 1-8.3.1 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.65.1 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6-RT_Update_14 | 0 | 1-150600.1.5.1 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6_Update_14 | 0 | 1-150600.13.3.4 |
| SUSE:Linux Enterprise Live Patching 15 SP7 | kernel-livepatch-SLE15-SP7-RT_Update_3 | 0 | 1-150700.1.5.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-64kb | 0 | 6.4.0-150600.23.65.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.65.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-default-base | 0 | 6.4.0-150600.23.65.1.150600.12.28.4 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-source | 0 | 6.4.0-150600.23.65.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-zfcpdump | 0 | 6.4.0-150600.23.65.1 |
| SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 | kernel-coco | 0 | 6.4.0-15061.28.coco15sp6.1 |
| SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 | kernel-coco_debug | 0 | 6.4.0-15061.28.coco15sp6.1 |
| SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 | kernel-source-coco | 0 | 6.4.0-15061.28.coco15sp6.1 |
| SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 | kernel-syms-coco | 0 | 6.4.0-15061.28.coco15sp6.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-docs | 0 | 6.4.0-150600.23.65.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-obs-build | 0 | 6.4.0-150600.23.65.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-source | 0 | 6.4.0-150600.23.65.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-syms | 0 | 6.4.0-150600.23.65.1 |
| SUSE:Linux Enterprise Module for Legacy 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.65.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-azure | 0 | 6.4.0-150600.8.48.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-source-azure | 0 | 6.4.0-150600.8.48.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-syms-azure | 0 | 6.4.0-150600.8.48.1 |
| SUSE:Linux Enterprise Server 12 SP5-LTSS | kernel-default | 0 | 4.12.14-122.269.1 |
| SUSE:Linux Enterprise Server 12 SP5-LTSS | kernel-source | 0 | 4.12.14-122.269.1 |
| SUSE:Linux Enterprise Server 12 SP5-LTSS | kernel-syms | 0 | 4.12.14-122.269.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | kernel-default | 0 | 4.12.14-122.269.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | kernel-source | 0 | 4.12.14-122.269.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | kernel-syms | 0 | 4.12.14-122.269.1 |
| SUSE:Linux Enterprise Workstation Extension 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.65.1 |
| SUSE:Real Time Module 15 SP6 | kernel-rt | 0 | 6.4.0-150600.10.49.1 |
| SUSE:Real Time Module 15 SP6 | kernel-rt_debug | 0 | 6.4.0-150600.10.49.1 |
| SUSE:Real Time Module 15 SP6 | kernel-source-rt | 0 | 6.4.0-150600.10.49.1 |
| SUSE:Real Time Module 15 SP6 | kernel-syms-rt | 0 | 6.4.0-150600.10.49.1 |
| SUSE:Real Time Module 15 SP7 | kernel-rt | 0 | 6.4.0-150700.7.13.1 |
| SUSE:Real Time Module 15 SP7 | kernel-source-rt | 0 | 6.4.0-150700.7.13.1 |
| SUSE:Real Time Module 15 SP7 | kernel-syms-rt | 0 | 6.4.0-150700.7.13.1 |
| openSUSE:Leap 15.6 | dtb-aarch64 | 0 | 6.4.0-150600.23.65.1 |
| openSUSE:Leap 15.6 | kernel-64kb | 0 | 6.4.0-150600.23.65.1 |
| openSUSE:Leap 15.6 | kernel-azure | 0 | 6.4.0-150600.8.48.1 |
| openSUSE:Leap 15.6 | kernel-debug | 0 | 6.4.0-150600.23.65.1 |
| openSUSE:Leap 15.6 | kernel-default | 0 | 6.4.0-150600.23.65.1 |
| openSUSE:Leap 15.6 | kernel-default-base | 0 | 6.4.0-150600.23.65.1.150600.12.28.4 |
| openSUSE:Leap 15.6 | kernel-docs | 0 | 6.4.0-150600.23.65.1 |
| openSUSE:Leap 15.6 | kernel-kvmsmall | 0 | 6.4.0-150600.23.65.1 |
| openSUSE:Leap 15.6 | kernel-obs-build | 0 | 6.4.0-150600.23.65.1 |
| openSUSE:Leap 15.6 | kernel-obs-qa | 0 | 6.4.0-150600.23.65.1 |
| openSUSE:Leap 15.6 | kernel-rt | 0 | 6.4.0-150600.10.49.1 |
| openSUSE:Leap 15.6 | kernel-rt_debug | 0 | 6.4.0-150600.10.49.1 |
| openSUSE:Leap 15.6 | kernel-source | 0 | 6.4.0-150600.23.65.1 |
| openSUSE:Leap 15.6 | kernel-source-azure | 0 | 6.4.0-150600.8.48.1 |
| openSUSE:Leap 15.6 | kernel-source-rt | 0 | 6.4.0-150600.10.49.1 |
| openSUSE:Leap 15.6 | kernel-syms | 0 | 6.4.0-150600.23.65.1 |
| openSUSE:Leap 15.6 | kernel-syms-azure | 0 | 6.4.0-150600.8.48.1 |
| openSUSE:Leap 15.6 | kernel-syms-rt | 0 | 6.4.0-150600.10.49.1 |
| openSUSE:Leap 15.6 | kernel-zfcpdump | 0 | 6.4.0-150600.23.65.1 |
Related vulnerabilities
- CVE-2025-39885 In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix recursive… Also affects linux
- CVE-2025-39883 In the Linux kernel, the following vulnerability has been resolved: mm/memory-failure… Also affects linux
- CVE-2025-39876 In the Linux kernel, the following vulnerability has been resolved: net: fec: Fix… Also affects linux
- CVE-2025-39869 In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: edma… Also affects linux
- CVE-2025-39873 In the Linux kernel, the following vulnerability has been resolved: can: xilinx_can… Also affects linux
- CVE-2025-39863 In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix… Also affects linux
- CVE-2025-39865 In the Linux kernel, the following vulnerability has been resolved: tee: fix NULL pointer… Also affects linux
- CVE-2025-39866 In the Linux kernel, the following vulnerability has been resolved: fs: writeback: fix… Also affects linux