CVE-2026-80724

Received Received - Intake

PTP vmclock Read-Only Mapping Privilege Escalation

Publication date: 2026-08-28

Last updated on: 2026-09-07

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ptp: vmclock: prevent read-only mappings from becoming writable vmclock_miscdev_mmap() rejects writable mappings of the shared vmclock ABI page with -EROFS, but leaves VM_MAYWRITE set. Userspace can map the page read-only and then upgrade it to writable with mprotect(), after which the guest can corrupt the host-written timekeeping data (sequence counter, UTC time, TSC offset) that the vmclock ABI defines as read-only. Clear VM_MAYWRITE on the read-only path so the mapping cannot be upgraded, as i915 does for its read-only objects and as fixed in drm/vc4 (CVE-2026-68445) and drm/panthor (CVE-2024-53071).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-09-07

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-80724

EUVD

EUVD-2026-67460

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the vmclock_miscdev_mmap() function. It allows userspace to map a read-only page and then upgrade it to writable using mprotect(), potentially corrupting timekeeping data on the host. The issue arises because VM_MAYWRITE remains set even after rejecting writable mappings.

Detection Guidance

This vulnerability affects the Linux kernel's vmclock PTP implementation. Detection requires checking kernel versions and vmclock module behavior. Inspect kernel logs for vmclock-related errors or unusual timekeeping anomalies. No direct commands are provided in the context to detect this specific issue.

Impact Analysis

If exploited, this vulnerability could allow a guest system to corrupt critical timekeeping data on the host, including sequence counters, UTC time, and TSC offset. This could lead to system instability, incorrect timekeeping, or potential security issues in time-sensitive operations.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel issue related to memory mapping permissions that could allow guest systems to corrupt host timekeeping data. Compliance impacts would depend on specific system configurations and use cases rather than this vulnerability itself.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. Monitor kernel updates from your distribution vendor. If using virtualization with vmclock, consider disabling or restricting access to the vmclock ABI until patched. No specific commands are provided in the context for mitigation.

Hi! I’m here to help you understand CVE-2026-80724. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70