CVE-2025-37910
ptp: ocp: Fix NULL dereference in Adva board SMA sysfs operations
Reported by linux · Published May 20, 2025
In the Linux kernel, the following vulnerability has been resolved: ptp: ocp: Fix NULL dereference in Adva board SMA sysfs operations On Adva boards, SMA sysfs store/get operations can call __handle_signal_outputs() or __handle_signal_inputs() while the `irig` and `dcf` pointers are uninitialized, leading to a NULL pointer dereference in __handle_signal() and causing a kernel crash. Adva boards don't use `irig` or `dcf` functionality, so add Adva-specific callbacks `ptp_ocp_sma_adva_set_outputs()` and `ptp_ocp_sma_adva_set_inputs()` that avoid invoking `irig` or `dcf` input/output routines.
EPSS 0.20% · 10.0th percentile
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| Linux | Linux | e98386d79a23c57cf179fe4138322e277aa3aa74, 8a543d825e78b8d680d8f891381b83fbffdb0bb6, 6.9, 5b349f9cdb4a9daa133bea267dfc0c383628387a |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | ef61f5528fca6c3bbb2f8bc002fd1949c9d1f9b9, ef61f5528fca6c3bbb2f8bc002fd1949c9d1f9b9, ef61f5528fca6c3bbb2f8bc002fd1949c9d1f9b9 |
| Linux | Linux | 6.9, 0, 6.12.28 |
| Linux | Linux | *, 6.15, * |
| linux | linux_kernel | 6.9, 6.9, 6.9 |
Timeline
- May 20, 2025 CVE Published
- May 21, 2025 EPSS Score (30 in total, the first dated here)
- Oct 24, 2025 PoC Published (3 in total, the first dated here)
- Nov 18, 2025 CVE Updated
- Jun 2, 2026 Security Advisory (196 in total, the first dated here)
- Jun 9, 2026 Coalition ESS Score
- Sep 19, 2026 Distribution Patch (188 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2025-37910
vulnetix vdb fixes CVE-2025-37910Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2025-37910/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart