CVE-2025-38054: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38054 is a NULL pointer dereference vulnerability in the Linux kernel's PTP (Precision Time Protocol) OCP driver, specifically in the debugfs summary output functions. The flaw arises from uninitialized element access in the freq_in[] and signal_out[] arrays, which can trigger a kernel Oops (page_fault_oops). Affected versions include Linux kernel 6.9 through 6.12.30 and 6.13 through 6.14.8, as well as release candidates 6.15-rc1 through 6.15-rc7. It was published on June 18, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is classified as CWE-908 (Use of Uninitialized Resource). The ptp_ocp driver's debugfs summary output functions iterate over freq_in[] and signal_out[] arrays without tracking how many elements have been initialized, leading to out-of-bounds access and NULL pointer dereferences when uninitialized entries are read. The fix introduces two u8 fields — nr_freq_in and nr_signal_out — to track the count of initialized elements (capped at 4 per array), and updates the summary functions to respect these limits. Exploitation requires local access with low privileges, such as the ability to read debugfs entries on a system with a PTP OCP hardware device (Feedly, Kernel Patch).

Successful exploitation causes a kernel Oops (page_fault_oops), resulting in a denial of service through system crash or kernel instability. There is no confidentiality or integrity impact — the vulnerability is limited to availability. Systems running affected kernel versions with PTP OCP hardware and accessible debugfs interfaces are at risk (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained to local, low-privilege attackers on systems with PTP OCP hardware and debugfs access (Feedly).

Update to a patched Linux kernel version: 6.12.31 or later for the 6.12 stable branch, or 6.14.9 or later for the 6.14 stable branch; kernel 6.15 (stable release) also includes the fix. The patches are available at the upstream kernel stable repository. As a workaround, restricting local user access to debugfs (e.g., mounting with debugfs restricted or unmounted) can reduce exposure. Systems without PTP OCP hardware are not affected (Feedly, Kernel Patch). Ubuntu has issued security notices USN-7771-1 and USN-7789-1 addressing this vulnerability (Ubuntu USN-7771-1, Ubuntu USN-7789-1).

Ubuntu issued security notices USN-7771-1 and USN-7789-1 covering this and related kernel vulnerabilities, indicating downstream distribution uptake of the fix (Ubuntu USN-7771-1, Ubuntu USN-7789-1). No notable independent researcher commentary or significant social media discussion has been observed for this vulnerability.