CVE-2025-38126
MediumIn the Linux kernel, the following vulnerability has been resolved: net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping The stmmac platform drivers that do not open-code the clk_ptp_rate value after having retrieved the default one from the device-tree can end up with 0 in clk_ptp_rate (as clk_get_rate can return 0). It will eventually propagate up to PTP initialization when bringing up the interface, leading to a divide by 0: Division by zero in kernel. CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.12.30-00001-g48313bd5768a #22 Hardware name: STM32 (Device Tree Support) Call trace: unwind_backtrace from show_stack+0x18/0x1c show_stack from dump_stack_lvl+0x6c/0x8c dump_stack_lvl from Ldiv0_64+0x8/0x18 Ldiv0_64 from stmmac_init_tstamp_counter+0x190/0x1a4 stmmac_init_tstamp_counter from stmmac_hw_setup+0xc1c/0x111c stmmac_hw_setup from __stmmac_open+0x18c/0x434 __stmmac_open from stmmac_open+0x3c/0xbc stmmac_open from __dev_open+0xf4/0x1ac __dev_open from __dev_change_flags+0x1cc/0x224 __dev_change_flags from dev_change_flags+0x24/0x60 dev_change_flags from ip_auto_config+0x2e8/0x11a0 ip_auto_config from do_one_initcall+0x84/0x33c do_one_initcall from kernel_init_freeable+0x1b8/0x214 kernel_init_freeable from kernel_init+0x24/0x140 kernel_init from ret_from_fork+0x14/0x28 Exception stack(0xe0815fb0 to 0xe0815ff8) Prevent this division by 0 by adding an explicit check and error log about the actual issue. While at it, remove the same check from stmmac_ptp_register, which then becomes duplicate
CVSS 3.1 score
5.5
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness type
CWE-369CVE-2025-38126 is a Divide By Zero vulnerability
What is Divide By Zero?
The product divides a value by zero, causing a crash or unexpected behaviour. Learn more on MITRE CWE
Affected versions
Linux kernel versions
4.5
and later are affected. Fixed in
6.1.142,
6.6.94,
6.12.34,
6.15.3,
6.16
and their respective stable series.
References
The following references provide additional information about CVE-2025-38126 including vendor advisories, patch commits, exploit details, and third-party analysis. Links are sourced from the NIST NVD database.
-
Third Party Advisory
-
PatchKernel patch commithttps://git.kernel.org/stable/c/030ce919e114a111e83b7976ecb3597cefd33f26
-
PatchKernel patch commithttps://git.kernel.org/stable/c/32af9c289234990752281c805500dfe03c5b2b8f
-
PatchKernel patch commithttps://git.kernel.org/stable/c/379cd990dfe752b38fcf46034698a9a150626c7a
Frequently asked questions
-
What is CVE-2025-38126?
CVE-2025-38126 is a Medium severity Linux kernel vulnerability with a CVSS score of 5.5 out of 10 , classified as a Divide By Zero flaw (CWE-369) . It affects Linux kernel versions from 4.5 onward and has been patched in 6.1.142, 6.6.94, 6.12.34 and others. CVE-2025-38126 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
What is the CVSS score for CVE-2025-38126?
CVE-2025-38126 has a CVSS score of 5.5 out of 10, rated Medium severity (CVSS 3.1). The vector string is
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. -
Is there a patch available for CVE-2025-38126?
Yes — CVE-2025-38126 has been patched. Fixed versions include 6.1.142, 6.6.94, 6.12.34 and others. If you are running Linux kernel 4.5 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2025-38126 actively exploited?
No — CVE-2025-38126 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.
-
What is Divide By Zero (CWE-369)?
The product divides a value by zero, causing a crash or unexpected behaviour. View CWE-369 on MITRE CWE →