CVE-2025-38148

What it actually does

Memory leak in Linux kernel net/phy/mscc driver during one-step PTP timestamping: skb allocated for TX frame is never freed because hardware inserts timestamp without generating completion interrupt.

Why it matters to the business

Gradual memory exhaustion on systems using one-step timestamping can degrade performance or cause crashes in network devices, servers, and embedded Linux deployments; urgency is moderate given low EPSS and no KEV listing despite 481 days since publication.

How an attack unfolds

An attacker configures one-step timestamping on an affected mscc PHY interface and generates repeated PTP sync traffic; each frame allocates an skb that is never released, leading to resource depletion. Listed threat actors appear tied to unrelated kernel privilege-escalation issues rather than this leak.

How to fix it

Upgrade to fixed kernel commit 24b24295464f25fb771d36ed558c7cd942119361 or harbor-registry-fips 3.0.0_alpha1-r31; apply the patch that frees the skb for one-step cases.

How to confirm the fix worked

Verify running kernel contains commit 24b24295464f25fb771d36ed558c7cd942119361, confirm PTP one-step mode no longer leaks memory under load, and monitor slab or kmalloc counters during timestamping tests.

Typical attack path

1. Identify hosts with mscc PHY and PTP one-step support enabled
2. Enable or force one-step timestamping configuration
3. Generate sustained PTP traffic to trigger repeated skb allocations
4. Monitor for memory growth until system impact occurs

How to detect it

Correlate rising memory usage or kmem_cache growth with PTP one-step traffic in system logs; inspect dmesg or kernel ring buffer for mscc PHY timestamping activity; review net_dev or skb allocation patterns on systems with the driver loaded.

What your security team should do

• Apply the referenced kernel commit or package update immediately on affected systems
• Temporarily disable one-step timestamping where operationally feasible
• Add memory usage alerts correlated with PTP traffic to detection rules
• Track EPSS trend and any new exploit maturity signals given 481-day exposure window