CVE-2026-80991

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: net: ravb: serialize PTP clock teardown ravb_ptp_interrupt() can race with ravb_ptp_stop() and pass the clock to ptp_clock_event() while ptp_clock_unregister() is freeing it. This can lead to a use-after-free. Use READ_ONCE() and WRITE_ONCE() for lockless access to the clock pointer. Atomically detach it with xchg() before disabling PTP interrupts, then synchronize all IRQs which can invoke ravb_ptp_interrupt() before unregistering the detached clock. A handler which read the old pointer completes before the clock is unregistered, while later handlers read NULL and skip the event.

Severity

HIGH

CVSS score

7.8 (v3.1)

Vulnerability status

Received

Source identifier

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Published

2026-09-11 20:19:05.993000

Last modified

2026-10-30 13:20:15.297000

View original CVE JSON

{
  "id": "CVE-2026-80991",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2026-09-11T20:19:05.993",
  "lastModified": "2026-10-30T13:20:15.297",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ravb: serialize PTP clock teardown\n\nravb_ptp_interrupt() can race with ravb_ptp_stop() and pass the clock to\nptp_clock_event() while ptp_clock_unregister() is freeing it. This can\nlead to a use-after-free.\n\nUse READ_ONCE() and WRITE_ONCE() for lockless access to the clock pointer.\nAtomically detach it with xchg() before disabling PTP interrupts, then\nsynchronize all IRQs which can invoke ravb_ptp_interrupt() before\nunregistering the detached clock.\n\nA handler which read the old pointer completes before the clock is\nunregistered, while later handlers read NULL and skip the event."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "drivers/net/ethernet/renesas/ravb.h",
            "drivers/net/ethernet/renesas/ravb_main.c",
            "drivers/net/ethernet/renesas/ravb_ptp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "a0d2f20650e81407d8e51ad2cbdc492861c74e9c",
              "lessThan": "0400b9c5608933289bcacc3886dd3e4f6b7695f1",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "a0d2f20650e81407d8e51ad2cbdc492861c74e9c",
              "lessThan": "b917f37bfcce919a969d66a044580a95b11df31c",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "a0d2f20650e81407d8e51ad2cbdc492861c74e9c",
              "lessThan": "695acb5534a9e366efb47b40c7487fc56488b09b",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "a0d2f20650e81407d8e51ad2cbdc492861c74e9c",
              "lessThan": "67a82e6f886beed0de8f8da08bb767e68fba952d",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "a0d2f20650e81407d8e51ad2cbdc492861c74e9c",
              "lessThan": "66b50c31419e7946e9aa325a468ad9b64c961a25",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "a0d2f20650e81407d8e51ad2cbdc492861c74e9c",
              "lessThan": "1cb9663789c5b7a12fcd419fcca6d6254c398252",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "drivers/net/ethernet/renesas/ravb.h",
            "drivers/net/ethernet/renesas/ravb_main.c",
            "drivers/net/ethernet/renesas/ravb_ptp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "4.2",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "4.2",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.1.191",
              "lessThanOrEqual": "6.1.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.6.160",
              "lessThanOrEqual": "6.6.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.109",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18.50",
              "lessThanOrEqual": "6.18.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.2.4",
              "lessThanOrEqual": "7.2.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.3",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9
      }
    ]
  },
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/0400b9c5608933289bcacc3886dd3e4f6b7695f1",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/1cb9663789c5b7a12fcd419fcca6d6254c398252",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/66b50c31419e7946e9aa325a468ad9b64c961a25",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/67a82e6f886beed0de8f8da08bb767e68fba952d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/695acb5534a9e366efb47b40c7487fc56488b09b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b917f37bfcce919a969d66a044580a95b11df31c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}