CVE-2026-80991

Received Received - Intake

Race Condition in Linux Kernel Ravb PTP Clock Handling

Publication date: 2026-09-11

Last updated on: 2026-09-13

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net: ravb: serialize PTP clock teardown ravb_ptp_interrupt() can race with ravb_ptp_stop() and pass the clock to ptp_clock_event() while ptp_clock_unregister() is freeing it. This can lead to a use-after-free. Use READ_ONCE() and WRITE_ONCE() for lockless access to the clock pointer. Atomically detach it with xchg() before disabling PTP interrupts, then synchronize all IRQs which can invoke ravb_ptp_interrupt() before unregistering the detached clock. A handler which read the old pointer completes before the clock is unregistered, while later handlers read NULL and skip the event.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-13

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-10-01

NVD

CVE-2026-80991

EUVD

EUVD-2026-76314

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's ravb network driver. It occurs when the PTP clock teardown process races with an interrupt handler. The ravb_ptp_interrupt() function may access a clock pointer that is being freed by ravb_ptp_stop(), leading to a use-after-free condition.

Detection Guidance

This vulnerability is specific to the Linux kernel's ravb driver and PTP clock handling. Detection requires checking kernel logs for use-after-free errors or PTP-related crashes. Monitor system logs with 'dmesg | grep -i ravb' or 'journalctl -k | grep -i ravb'. If you suspect exploitation, look for kernel oops or panic messages.

Impact Analysis

This vulnerability could allow an attacker to cause a denial of service or potentially execute arbitrary code with kernel privileges. It affects systems using the ravb network driver with PTP clock functionality.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a use-after-free issue in the Linux kernel's network driver (ravb) related to PTP clock handling, which could lead to system instability or crashes but does not involve data privacy or security controls typically regulated by these standards.

Mitigation Strategies

Update your Linux kernel to the latest stable version where this issue is resolved. If immediate patching is not possible, disable the ravb driver or PTP functionality if not required. Monitor vendor advisories for kernel updates addressing this CVE.

Hi! I’m here to help you understand CVE-2026-80991. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70