# CVE-2025-38305: ptp: remove ptp->n_vclocks check logic in ptp_vclock_in_use()

Status: published. Published: 2025-07-10. Updated: 2026-11-05.

In the Linux kernel, the following vulnerability has been resolved:

ptp: remove ptp->n_vclocks check logic in ptp_vclock_in_use()

There is no disagreement that we should check both ptp->is_virtual_clock
and ptp->n_vclocks to check if the ptp virtual clock is in use.

However, when we acquire ptp->n_vclocks_mux to read ptp->n_vclocks in
ptp_vclock_in_use(), we observe a recursive lock in the call trace
starting from n_vclocks_store().

============================================
WARNING: possible recursive locking detected
6.15.0-rc6 #1 Not tainted
--------------------------------------------
syz.0.1540/13807 is trying to acquire lock:
ffff888035a24868 (&ptp->n_vclocks_mux){+.+.}-{4:4}, at:
 ptp_vclock_in_use drivers/ptp/ptp_private.h:103 [inline]
ffff888035a24868 (&ptp->n_vclocks_mux){+.+.}-{4:4}, at:
 ptp_clock_unregister+0x21/0x250 drivers/ptp/ptp_clock.c:415

but task is already holding lock:
ffff888030704868 (&ptp->n_vclocks_mux){+.+.}-{4:4}, at:
 n_vclocks_store+0xf1/0x6d0 drivers/ptp/ptp_sysfs.c:215

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(&ptp->n_vclocks_mux);
  lock(&ptp->n_vclocks_mux);

 *** DEADLOCK ***
....
============================================

The best way to solve this is to remove the logic that checks
ptp->n_vclocks in ptp_vclock_in_use().

The reason why this is appropriate is that any path that uses
ptp->n_vclocks must unconditionally check if ptp->n_vclocks is greater
than 0 before unregistering vclocks, and all functions are already
written this way. And in the function that uses ptp->n_vclocks, we
already get ptp->n_vclocks_mux before unregistering vclocks.

Therefore, we need to remove the redundant check for ptp->n_vclocks in
ptp_vclock_in_use() to prevent recursive locking.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- Linux / Linux: ≥ 73f37068d540eba5f93ba3a0019bf479d35ebd76; < 5d217e7031a5c06d366580fc6ddbf43527b780d4 (affected, git); ≥ 73f37068d540eba5f93ba3a0019bf479d35ebd76; < b1b73c452331451020be3bf4b014901015ae6663 (affected, git); ≥ 73f37068d540eba5f93ba3a0019bf479d35ebd76; < 259119595227fd20f6aa29d85abe086b6fdd9eb1 (affected, git); ≥ 73f37068d540eba5f93ba3a0019bf479d35ebd76; < b93e6fef4eda48e17d9c642b9abad98a066fd4a3 (affected, git); ≥ 73f37068d540eba5f93ba3a0019bf479d35ebd76; < ef8fc007c28a30a4c0d90bf755e0f343d99bb392 (affected, git); ≥ 73f37068d540eba5f93ba3a0019bf479d35ebd76; < 87f7ce260a3c838b49e1dc1ceedf1006795157a2 (affected, git). Source: CNA: Linux
- Linux / Linux: 5.14 (affected); ≥ 0; < 5.14 (unaffected, semver); ≥ 5.15.186; ≤ 5.15.* (unaffected, semver); ≥ 6.1.142; ≤ 6.1.* (unaffected, semver); ≥ 6.6.94; ≤ 6.6.* (unaffected, semver); ≥ 6.12.34; ≤ 6.12.* (unaffected, semver); ≥ 6.15.3; ≤ 6.15.* (unaffected, semver); ≥ 6.16; ≤ * (unaffected, original_commit_for_fix). Source: CNA: Linux

## Severity and prioritization

- CISA KEV: No listing in collected sources

- EPSS: 0.18% as of 2026-11-05; percentile 7.54%

- SSVC: exploitation none; automatable no; technical impact partial; source ADP: CISA-ADP

- Weaknesses: Not reported

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://git.kernel.org/stable/c/5d217e7031a5c06d366580fc6ddbf43527b780d4 (CNA: Linux)

- https://git.kernel.org/stable/c/b1b73c452331451020be3bf4b014901015ae6663 (CNA: Linux)

- https://git.kernel.org/stable/c/259119595227fd20f6aa29d85abe086b6fdd9eb1 (CNA: Linux)

- https://git.kernel.org/stable/c/b93e6fef4eda48e17d9c642b9abad98a066fd4a3 (CNA: Linux)

- https://git.kernel.org/stable/c/ef8fc007c28a30a4c0d90bf755e0f343d99bb392 (CNA: Linux)

- https://git.kernel.org/stable/c/87f7ce260a3c838b49e1dc1ceedf1006795157a2 (CNA: Linux)

- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html (ADP: CVE)

## Provenance

- CNA: Linux: https://www.cve.org/CVERecord?id=CVE-2025-38305; retrieved 2026-11-05; source updated 2026-11-05

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2025-38305; retrieved 2026-11-05; source updated Not reported

Revision: 5dda837988cbe5ba23f909ec7ca00075027dabb7e162708ac8a26ff324bc6ac2

Canonical: https://y2.dev/cve/CVE-2025-38305

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.