CVE-2026-80991
In the Linux kernel, the following vulnerability has been resolved: net: ravb: serialize PTP clock teardown ravb_ptp_interrupt() can race with ravb_ptp_stop() …
Impact
In the Linux kernel, the following vulnerability has been resolved: net: ravb: serialize PTP clock teardown ravb_ptp_interrupt() can race with ravb_ptp_stop() and pass the clock to ptp_clock_event() while ptp_clock_unregister() is freeing it. This can lead to a use-after-free. Use READ_ONCE() and WRITE_ONCE() for lockless access to the clock pointer. Atomically detach it with xchg() before disabling PTP interrupts, then synchronize all IRQs which can invoke ravb_ptp_interrupt() before unregistering the detached clock. A handler which read the old pointer completes before the clock is unregistered, while later handlers read NULL and skip the event.
Affected packages
This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.
References
- NVD record
- CVE.org record
- https://git.kernel.org/stable/c/0400b9c5608933289bcacc3886dd3e4f6b7695f1
- https://git.kernel.org/stable/c/1cb9663789c5b7a12fcd419fcca6d6254c398252
- https://git.kernel.org/stable/c/66b50c31419e7946e9aa325a468ad9b64c961a25
- https://git.kernel.org/stable/c/67a82e6f886beed0de8f8da08bb767e68fba952d
- https://git.kernel.org/stable/c/695acb5534a9e366efb47b40c7487fc56488b09b
- https://git.kernel.org/stable/c/b917f37bfcce919a969d66a044580a95b11df31c