Linux Kernel PTP Clock NULL Dereference Vulnerability in GVE Driver

Vulnerability

A vulnerability in the Linux kernel's GVE (Google Virtual Ethernet) driver for Precision Time Protocol (PTP) clocks has been addressed. The issue arose because the PTP clock settime64 function was assumed to be implemented by all PTP clocks, leading to a potential NULL dereference. The vulnerability has been fixed by stubbing the function with -EOPNOTSUPP, indicating that the operation is not supported. This change prevents a NULL dereference that could occur when the assumption is incorrect.

Impact

Exploitation of this vulnerability could lead to a NULL pointer dereference, causing a crash or undefined behavior in the kernel.

Added: Dec 8, 2025, 1:44 AM
Updated: Dec 8, 2025, 1:44 AM

Vulnerability Rating

Custom Algorithm
spread
9.0
impact
2.5
exploitability
5.3
remediation
7.7
relevance
1.4
threat
3.2
urgency
2.9
incentive
1.7

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.