CVE-2025-40255

In the Linux kernel, the following vulnerability has been resolved:

net: core: prevent NULL deref in generichwtstampioctl_lower()

The ethtool tsconfig Netlink path can trigger a null pointer dereference. A call chain such as:

tsconfigpreparedata() -> devgethwtstampphylib() -> vlanhwtstampget() -> generichwtstampgetlower() -> generichwtstampioctl_lower()

results in generichwtstampioctllower() being called with kernelcfg->ifr as NULL.

The generichwtstampioctl_lower() function does not expect a NULL ifr and dereferences it, leading to a system crash.

Fix this by adding a NULL check for kernelcfg->ifr in generichwtstampioctllower(). If ifr is NULL, return -EINVAL.