CVE-2025-68752

A NULL pointer dereference vulnerability was found in the Intel Adaptive Virtual Function (iavf) network driver in the Linux kernel. The driver registers a PTP clock device but does not implement the settime64() callback. When ptp_clock_settime() is called, it assumes the callback exists and dereferences a NULL function pointer, causing a kernel crash.

This vulnerability requires local access and the ability to interact with PTP clock devices. Exploitation leads to a kernel panic but does not allow code execution or data compromise. Systems using iavf virtual network adapters in virtualized environments with PTP enabled are affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the iavf module from being loaded if Intel Adaptive Virtual Function network devices are not required. See https://access.redhat.com/solutions/41278 for instructions on how to blacklist a kernel module.