CVE-2025-38148

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-38148
In the Linux kernel, the following vulnerability has been resolved: net: phy: mscc: Fix memory leak when using one step timestamping Fix memory leak when running one-step timestamping. When running one-step sync timestamping, the HW is configured to insert the TX time into the frame, so there is no reason to keep the skb anymore. As in this case the HW will never generate an interrupt to say that the frame was timestamped, then the frame will never released. Fix this by freeing the frame in case of one-step timestamping.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/0b40aeaf83ca04d4c9801e235b7533400c8b5f17 Patch
https://git.kernel.org/stable/c/24b24295464f25fb771d36ed558c7cd942119361 Patch
https://git.kernel.org/stable/c/66abe22017522dd56b820e41ca3a5b131a637001 Patch
https://git.kernel.org/stable/c/846992645b25ec4253167e3f931e4597eb84af56 Patch
https://git.kernel.org/stable/c/cdbabd316c5a4a9b0fda6aafe491e2db17fbb95d Patch
https://git.kernel.org/stable/c/db2a12ddd3a31f668137ff6a4befc1343c79cbc4 Patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
History

18 Dec 2025, 21:06

Type Values Removed Values Added
First Time Linux
Debian
Debian debian Linux
Linux linux Kernel
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE CWE-401
References () https://git.kernel.org/stable/c/0b40aeaf83ca04d4c9801e235b7533400c8b5f17 - () https://git.kernel.org/stable/c/0b40aeaf83ca04d4c9801e235b7533400c8b5f17 - Patch
References () https://git.kernel.org/stable/c/24b24295464f25fb771d36ed558c7cd942119361 - () https://git.kernel.org/stable/c/24b24295464f25fb771d36ed558c7cd942119361 - Patch
References () https://git.kernel.org/stable/c/66abe22017522dd56b820e41ca3a5b131a637001 - () https://git.kernel.org/stable/c/66abe22017522dd56b820e41ca3a5b131a637001 - Patch
References () https://git.kernel.org/stable/c/846992645b25ec4253167e3f931e4597eb84af56 - () https://git.kernel.org/stable/c/846992645b25ec4253167e3f931e4597eb84af56 - Patch
References () https://git.kernel.org/stable/c/cdbabd316c5a4a9b0fda6aafe491e2db17fbb95d - () https://git.kernel.org/stable/c/cdbabd316c5a4a9b0fda6aafe491e2db17fbb95d - Patch
References () https://git.kernel.org/stable/c/db2a12ddd3a31f668137ff6a4befc1343c79cbc4 - () https://git.kernel.org/stable/c/db2a12ddd3a31f668137ff6a4befc1343c79cbc4 - Patch
References () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html - () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html - Third Party Advisory
CPE cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

03 Nov 2025, 18:16

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html -

09 Sep 2025, 17:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/24b24295464f25fb771d36ed558c7cd942119361 -

03 Jul 2025, 15:13

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: phy: mscc: Se corrige la pérdida de memoria al usar el sellado de tiempo de un paso. Al ejecutar el sellado de tiempo de sincronización de un paso, el hardware está configurado para insertar la hora de transmisión en la trama, por lo que ya no hay razón para mantener el skb. Como en este caso, el hardware nunca generará una interrupción para indicar que la trama fue sellada, esta nunca se liberará. Se corrige liberando la trama en caso de sellado de tiempo de un paso.

03 Jul 2025, 09:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-07-03 09:15

Updated : 2025-12-18 21:06

NVD link : CVE-2025-38148

Mitre link : CVE-2025-38148

CVE.ORG link : CVE-2025-38148

JSON object : View

Products Affected

debian

  • debian_linux

linux

  • linux_kernel
CWE
CWE-401

Missing Release of Memory after Effective Lifetime