Critical Division by Zero Vulnerability in Linux Kernel's stmmac Driver
Summary
CVE-2025-38126: In the Linux kernel, the following vulnerability has been resolved: net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping The stmmac platform drivers that do not open-code the clk_ptp_rate value a... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interaction. The stmmac driver is responsible for managing Ethernet interfaces, enabling network connectivity. This driver is widely used across various hardware platforms, including STM32 devices. The vulnerability in question arises from improper handling of the clk_ptp_rate value, which can lead to critical errors during timestamping configuration.
Vulnerability Detail
In the Linux kernel, specifically within the stmmac driver, a vulnerability exists where the clk_ptp_rate value may be set to zero if not properly initialized. This can occur when the driver retrieves the default value from the device-tree but fails to validate it. As a result, during the PTP (Precision Time Protocol) initialization, a division by zero error can occur, potentially leading to system crashes or undefined behavior. This vulnerability affects systems running kernel versions prior to the patch and can be exploited during network interface initialization.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can manually check the clk_ptp_rate value before initializing the PTP timestamping. If the value is zero, the initialization process should be halted, and an error message should be logged to prevent the division by zero error.
Conclusion
The CVE-2025-38126 vulnerability in the Linux kernel's stmmac driver poses a significant risk due to the potential for division by zero errors. Users are strongly advised to update their kernel to the latest patched version to ensure system stability and security. For those unable to update immediately, implementing a manual check for the clk_ptp_rate value can serve as a temporary workaround.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38126 is a vulnerability in the Linux kernel's stmmac driver that can lead to a division by zero error during PTP initialization.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The vulnerability can cause system crashes or undefined behavior due to a division by zero error during network interface initialization.
Yes, a patch has been released for the Linux kernel. Users should update to the latest version to mitigate the vulnerability.
As a temporary measure, ensure that the clk_ptp_rate value is validated before PTP initialization to prevent the division by zero error.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
