CVE-2026-53222

Analyzed Analyzed - Analysis Complete

Linux Kernel PTP OCP Resource Use-After-Free

Publication date: 2026-06-25

Last updated on: 2026-07-02

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ptp: ocp: fix resource freeing order Commit a60fc3294a37 ("ptp: rework ptp_clock_unregister() to disable events") added a call to ptp_disable_all_events() which changes the configuration of pins if they support EXTTS events. In ptp_ocp_detach() pins resources are freed before ptp_clock_unregister() and it leads to use-after-free during driver removal. Fix it by changing the order of free/unregister calls. To avoid irq handler running on the other core while ptp device unregistering, call synchronize_irq() after HW is configured to stop producing irqs and no irqs are in-flight.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-25

Last Modified

2026-07-02

Generated

2026-07-15

AI Q&A

2026-06-25

EPSS Evaluated

2026-07-14

NVD

CVE-2026-53222

EUVD

EUVD-2026-39313

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.18 (inc) to 7.0.13 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-401	The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's ptp (Precision Time Protocol) driver, specifically related to the ocp component. A recent code change introduced a call to ptp_disable_all_events() which modifies pin configurations if they support EXTT events. However, during driver removal, the pins' resources are freed before the ptp_clock_unregister() function is called, leading to a use-after-free condition. This means that the driver attempts to access resources that have already been freed, which can cause instability or crashes. The fix involves changing the order of freeing resources and unregistering the clock, and ensuring that interrupt handlers are properly synchronized to avoid running on other cores during device unregistration.

Impact Analysis

The use-after-free vulnerability in the ptp ocp driver can lead to system instability or crashes during driver removal. This could potentially cause denial of service if the kernel crashes or behaves unpredictably. Additionally, improper handling of interrupts during device unregistration might lead to race conditions or unexpected behavior in the system.

Mitigation Strategies

The vulnerability is fixed by changing the order of resource freeing and unregister calls in the ptp_ocp driver within the Linux kernel.

To mitigate this vulnerability, you should update your Linux kernel to a version that includes the fix for this issue, specifically the commit a60fc3294a37 or later.

Hi! I’m here to help you understand CVE-2026-53222. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70