CVE-2025-40299: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-40299 is a NULL pointer dereference vulnerability in the Linux kernel's Google Virtual Ethernet (GVE) driver. The GVE driver implemented a ptp_clock for exclusive use of do_aux_work, but ptp_clock_gettime() and ptp_sys_offset() assume every ptp_clock has implemented either gettimex64 or gettime64. The absence of these implementations could lead to a NULL dereference. It was published on December 8, 2025, and affects Linux kernel versions from commit acd16380523b up to (but not including) the patched commits in the 6.17 and 6.18 series. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a missing function pointer implementation (CWE-476: NULL Pointer Dereference) in the GVE driver's PTP clock operations. The GVE driver registered a ptp_clock structure without implementing the gettimex64 or gettime64 callbacks, which are assumed to be present by ptp_clock_gettime() and ptp_sys_offset(). When either of these kernel functions is called on the GVE PTP clock, they dereference the NULL function pointer, triggering a kernel panic. The fix stubs out gettimex64 to return -EOPNOTSUPP, preventing the NULL dereference. Exploitation requires local access with low privileges to trigger the vulnerable PTP clock code path (Red Hat Bugzilla, Red Hat Advisory).

Successful exploitation results in a kernel NULL pointer dereference, causing a system crash (kernel panic) and denial of service. The impact is limited to availability — there is no confidentiality or integrity impact. The vulnerability affects systems running the GVE driver, which is primarily used in Google Cloud virtual machine environments. An attacker with local, low-privileged access could crash the host kernel, disrupting all workloads on the affected instance (Red Hat Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-40299. The EPSS score is approximately 0.018%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and the ability to invoke PTP clock operations on a system using the GVE driver, significantly limiting the attack surface to Google Cloud VM environments (Red Hat Advisory).

The vulnerability is patched in Linux kernel commits 96ec90412ceb (for the 6.17.x stable branch) and 6ab753b5d8e5 (for the 6.18 mainline), both available as of December 2025. Users should update to Linux kernel 6.17.8 or 6.18 (or later) to receive the fix. Systems not using the GVE driver (i.e., not running on Google Cloud infrastructure) are not affected. No configuration-based workaround is documented; upgrading the kernel is the recommended remediation (Red Hat Advisory, Red Hat Bugzilla).