CVE-2026-53222
Received Received - Intake
Linux Kernel PTP OCP Resource Use-After-Free

Publication date: 2026-06-25

Last updated on: 2026-06-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ptp: ocp: fix resource freeing order Commit a60fc3294a37 ("ptp: rework ptp_clock_unregister() to disable events") added a call to ptp_disable_all_events() which changes the configuration of pins if they support EXTTS events. In ptp_ocp_detach() pins resources are freed before ptp_clock_unregister() and it leads to use-after-free during driver removal. Fix it by changing the order of free/unregister calls. To avoid irq handler running on the other core while ptp device unregistering, call synchronize_irq() after HW is configured to stop producing irqs and no irqs are in-flight.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-25
Last Modified
2026-06-25
Generated
2026-06-25
AI Q&A
2026-06-25
EPSS Evaluated
N/A
NVD
CVE-2026-53222
EUVD
EUVD-2026-39313
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the Linux kernel's ptp (Precision Time Protocol) driver, specifically related to the ocp component. A recent code change introduced a call to ptp_disable_all_events() which modifies pin configurations if they support EXTT events. However, during driver removal, the pins' resources are freed before the ptp_clock_unregister() function is called, leading to a use-after-free condition. This means that the driver attempts to access resources that have already been freed, which can cause instability or crashes. The fix involves changing the order of freeing resources and unregistering the clock, and ensuring that interrupt handlers are properly synchronized to avoid running on other cores during device unregistration.

Impact Analysis

The use-after-free vulnerability in the ptp ocp driver can lead to system instability or crashes during driver removal. This could potentially cause denial of service if the kernel crashes or behaves unpredictably. Additionally, improper handling of interrupts during device unregistration might lead to race conditions or unexpected behavior in the system.

Mitigation Strategies

The vulnerability is fixed by changing the order of resource freeing and unregister calls in the ptp_ocp driver within the Linux kernel.

To mitigate this vulnerability, you should update your Linux kernel to a version that includes the fix for this issue, specifically the commit a60fc3294a37 or later.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53222. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart