CVE-2025-37910: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability (CVE-2025-37910) was discovered in the Linux kernel affecting the PTP (Precision Time Protocol) OCP functionality. The issue was identified on May 20, 2025, specifically impacting Adva board SMA sysfs operations. The vulnerability occurs when store/get operations call __handle_signal_outputs() or __handle_signal_inputs() while the irig and dcf pointers are uninitialized (NVD, Ubuntu).

The vulnerability stems from a NULL pointer dereference in the PTP OCP subsystem. On Adva boards, the SMA sysfs store/get operations could invoke __handle_signal_outputs() or __handle_signal_inputs() functions while the irig and dcf pointers remained uninitialized. Since Adva boards don't utilize irig or dcf functionality, the fix involved implementing Adva-specific callbacks ptp_ocp_sma_adva_set_outputs() and ptp_ocp_sma_adva_set_inputs() to avoid invoking the problematic input/output routines (NVD, Wiz).

When exploited, this vulnerability results in a kernel crash due to the NULL pointer dereference, potentially causing system instability and denial of service conditions on affected systems (Wiz).

The vulnerability has been patched by adding Adva-specific callbacks that prevent the invocation of the problematic irig or dcf input/output routines. Users should update to the patched version of the Linux kernel that includes these fixes (Wiz).