CVE-2025-40175
idpf: cleanup remaining SKBs in PTP flows
Reported by linux · Published November 12, 2025
In the Linux kernel, the following vulnerability has been resolved: idpf: cleanup remaining SKBs in PTP flows When the driver requests Tx timestamp value, one of the first steps is to clone SKB using skb_get. It increases the reference counter for that SKB to prevent unexpected freeing by another component. However, there may be a case where the index is requested, SKB is assigned and never consumed by PTP flows - for example due to reset during running PTP apps. Add a check in release timestamping function to verify if the SKB assigned to Tx timestamp latch was freed, and release remaining SKBs.
EPSS 0.19% · 8.2th percentile
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| Linux | Linux | a3f8c0a273120fd2638f03403e786c3de2382e72, 6.16, 2c84e91ef831d4fedb0b94670b3cfd1cc5f966a5 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | 4901e83a94ef0a8baf27916f31daf59b0a68547f, 4901e83a94ef0a8baf27916f31daf59b0a68547f |
| Linux | Linux | 6.16, 0, 6.17.5 |
| Linux | Linux | 6.16, 6.17.5, 6.18 |
| linux | linux_kernel | 6.16, 6.16 |
Timeline
- Nov 11, 2025 CVE Published
- Nov 12, 2025 EPSS Score (30 in total, the first dated here)
- Mar 29, 2026 Distribution Patch (164 in total, the first dated here)
- Mar 29, 2026 Security Advisory (170 in total, the first dated here)
- Jun 8, 2026 Coalition ESS Score
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2025-40175
vulnetix vdb fixes CVE-2025-40175Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2025-40175/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart