CVE-2025-68215High· 7.0▾ Twilight

In the Linux kernel, the following vulnerability has been resolved: ice: fix PTP cleanup on driver removal in error path Improve the cleanup on releasing PTP resources in error path. The error case might happen either at the driver pro…

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score39/ 100 · Low

impact 38.5 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Dec 16, 2025

Updated

Oct 15, 2026

CVSS

7.0

Vendor

Linux

Product

Linux

CWE

—

Depth score

39 · Low

EPSS

0.14% · p4

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

decided 2026-10-15

Exploitation: none
Automatable: no
Technical impact: total

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.

EPSS history

Exploit-prediction probability, daily snapshots since Oct 14.

0.1% → 0.1%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 303 days

Dec 16, 2025Published
Disclosed via NVD
Oct 14, 2026EPSS first tracked
0.1%
Oct 15, 2026Record revised
Last analysed / modified upstream

Linux #nvd #cve.org

Affected

Linux >= 2f59743be4d9568cad2d9cf697d1b897975421ed < f5eb91f876ebecbcd90f9edcaea98dcb354603b3
Linux >= e800654e85b5b27966fc6493201f5f8cf658beb6 < 765236f2c4fbba7650436b71a0e350500e9ec15f
Linux >= e800654e85b5b27966fc6493201f5f8cf658beb6 < 23a5b9b12de9dcd15ebae4f1abc8814ec1c51ab0
Linux >= 6.12.11 < 6.12.60
Linux 6.13

Full technical detail▾

Overview

In the Linux kernel, the following vulnerability has been resolved:

ice: fix PTP cleanup on driver removal in error path

Improve the cleanup on releasing PTP resources in error path. The error case might happen either at the driver probe and PTP feature initialization or on PTP restart (errors in reset handling, NVM update etc). In both cases, calls to PF PTP cleanup (ice_ptp_cleanup_pf function) and 'ps_lock' mutex deinitialization were missed. Additionally, ptp clock was not unregistered in the latter case.

Keep PTP state as 'uninitialized' on init to distinguish between error scenarios and to avoid resource release duplication at driver removal.

The consequence of missing ice_ptp_cleanup_pf call is the following call trace dumped when ice_adapter object is freed (port list is not empty, as it is required at this stage):

[ T93022] ------------[ cut here ]------------ [ T93022] WARNING: CPU: 10 PID: 93022 at ice/ice_adapter.c:67 ice_adapter_put+0xef/0x100 [ice] ... [ T93022] RIP: 0010:ice_adapter_put+0xef/0x100 [ice] ... [ T93022] Call Trace: [ T93022] <TASK> [ T93022] ? ice_adapter_put+0xef/0x100 [ice 33d2647ad4f6d866d41eefff1806df37c68aef0c] [ T93022] ? __warn.cold+0xb0/0x10e [ T93022] ? ice_adapter_put+0xef/0x100 [ice 33d2647ad4f6d866d41eefff1806df37c68aef0c] [ T93022] ? report_bug+0xd8/0x150 [ T93022] ? handle_bug+0xe9/0x110 [ T93022] ? exc_invalid_op+0x17/0x70 [ T93022] ? asm_exc_invalid_op+0x1a/0x20 [ T93022] ? ice_adapter_put+0xef/0x100 [ice 33d2647ad4f6d866d41eefff1806df37c68aef0c] [ T93022] pci_device_remove+0x42/0xb0 [ T93022] device_release_driver_internal+0x19f/0x200 [ T93022] driver_detach+0x48/0x90 [ T93022] bus_remove_driver+0x70/0xf0 [ T93022] pci_unregister_driver+0x42/0xb0 [ T93022] ice_module_exit+0x10/0xdb0 [ice 33d2647ad4f6d866d41eefff1806df37c68aef0c] ... [ T93022] ---[ end trace 0000000000000000 ]--- [ T93022] ice: module unloaded

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#cve.org