CVE-2026-97963
Received Received - Intake

Linux kernel PTP Lock Initialization Flaw

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: stmmac: initialize ptp_lock at probe time priv->ptp_lock is only initialized in stmmac_ptp_register(), which runs during __stmmac_open(). However, the lock is also used while the interface is down and has never been opened: tc_taprio_configure() invokes the PTP gettime64() callback to compute the EST base time when offloading a TAPRIO schedule, and stmmac_get_time() takes priv->ptp_lock. Using an uninitialized rwlock is undefined behaviour. Move the rwlock_init() to __stmmac_dvr_probe(), together with the other private locks, so that ptp_lock is always valid regardless of the interface state.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97963
EUVD
EUVD-2026-86817

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves an uninitialized lock in the stmmac network driver. The ptp_lock is used for PTP (Precision Time Protocol) operations but is only initialized when the network interface is opened. If the interface is down, the lock remains uninitialized, leading to undefined behavior when accessed by functions like tc_taprio_configure() during TAPRIO schedule offloading.

Detection Guidance

This vulnerability may not have direct detection commands as it involves a kernel lock initialization issue. Monitor kernel logs for stmmac-related errors or crashes, particularly during interface initialization or PTP operations. Check if the stmmac driver is loaded and examine its initialization sequence.

Impact Analysis

This vulnerability could cause system instability or crashes if the uninitialized lock is accessed while the network interface is down. It may lead to unpredictable behavior in time-sensitive network operations, potentially disrupting services relying on precise timing.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for CVE-2026-97963. If using a custom kernel, ensure the stmmac driver's ptp_lock is initialized in __stmmac_dvr_probe() before any PTP operations occur.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97963. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart