CVE-2026-31396: net: macb: fix use-after-free access to PTP clock
In the Linux kernel, the following vulnerability has been resolved:
net: macb: fix use-after-free access to PTP clock
PTP clock is registered on every opening of the interface and destroyed on every closing. However it may be accessed via gettsinfo ethtool call which is possible while the interface is just present in the kernel.
BUG: KASAN: use-after-free in ptpclockindex+0x47/0x50 drivers/ptp/ptpclock.c:426 Read of size 4 at addr ffff8880194345cc by task syz.0.6/948
CPU: 1 PID: 948 Comm: syz.0.6 Not tainted 6.1.164+ #109 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.1-0-g3208b098f51a-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> dumpstack lib/dumpstack.c:88 [inline] dumpstacklvl+0x8d/0xba lib/dumpstack.c:106 printaddressdescription mm/kasan/report.c:316 [inline] printreport+0x17f/0x496 mm/kasan/report.c:420 kasanreport+0xd9/0x180 mm/kasan/report.c:524 ptpclockindex+0x47/0x50 drivers/ptp/ptpclock.c:426 gemgettsinfo+0x138/0x1e0 drivers/net/ethernet/cadence/macbmain.c:3349 macbgettsinfo+0x68/0xb0 drivers/net/ethernet/cadence/macbmain.c:3371 ethtoolgettsinfo+0x17c/0x260 net/ethtool/common.c:558 ethtoolgettsinfo net/ethtool/ioctl.c:2367 [inline] devethtool net/ethtool/ioctl.c:3017 [inline] devethtool+0x2b05/0x6290 net/ethtool/ioctl.c:3095 devioctl+0x637/0x1070 net/core/devioctl.c:510 sockdoioctl+0x20d/0x2c0 net/socket.c:1215 sockioctl+0x577/0x6d0 net/socket.c:1320 vfsioctl fs/ioctl.c:51 [inline] dosysioctl fs/ioctl.c:870 [inline] sesysioctl fs/ioctl.c:856 [inline] x64sysioctl+0x18c/0x210 fs/ioctl.c:856 dosyscallx64 arch/x86/entry/common.c:46 [inline] dosyscall64+0x35/0x80 arch/x86/entry/common.c:76 entrySYSCALL64afterhwframe+0x6e/0xd8 </TASK>
Allocated by task 457: kmalloc include/linux/slab.h:563 [inline] kzalloc include/linux/slab.h:699 [inline] ptpclockregister+0x144/0x10e0 drivers/ptp/ptpclock.c:235 gemptpinit+0x46f/0x930 drivers/net/ethernet/cadence/macbptp.c:375 macbopen+0x901/0xd10 drivers/net/ethernet/cadence/macbmain.c:2920 devopen+0x2ce/0x500 net/core/dev.c:1501 devchangeflags+0x56a/0x740 net/core/dev.c:8651 devchangeflags+0x92/0x170 net/core/dev.c:8722 dosetlink+0xaf8/0x3a80 net/core/rtnetlink.c:2833 rtnlnewlink+0xbf4/0x1940 net/core/rtnetlink.c:3608 rtnlnewlink+0x63/0xa0 net/core/rtnetlink.c:3655 rtnetlinkrcvmsg+0x3c6/0xed0 net/core/rtnetlink.c:6150 netlinkrcvskb+0x15d/0x430 net/netlink/afnetlink.c:2511 netlinkunicastkernel net/netlink/afnetlink.c:1318 [inline] netlinkunicast+0x6d7/0xa30 net/netlink/afnetlink.c:1344 netlinksendmsg+0x97e/0xeb0 net/netlink/afnetlink.c:1872 socksendmsgnosec net/socket.c:718 [inline] socksendmsg+0x14b/0x180 net/socket.c:730 syssendto+0x320/0x3b0 net/socket.c:2152 dosyssendto net/socket.c:2164 [inline] sesyssendto net/socket.c:2160 [inline] x64syssendto+0xdc/0x1b0 net/socket.c:2160 dosyscallx64 arch/x86/entry/common.c:46 [inline] dosyscall64+0x35/0x80 arch/x86/entry/common.c:76 entrySYSCALL64afterhwframe+0x6e/0xd8
Freed by task 938: kasanslabfree include/linux/kasan.h:177 [inline] slabfreehook mm/slub.c:1729 [inline] slabfreefreelisthook mm/slub.c:1755 [inline] slabfree mm/slub.c:3687 [inline] kmemcachefree+0xbc/0x320 mm/slub.c:3700 devicerelease+0xa0/0x240 drivers/base/core.c:2507 kobjectcleanup lib/kobject.c:681 [inline] kobjectrelease lib/kobject.c:712 [inline] krefput include/linux/kref.h:65 [inline] kobjectput+0x1cd/0x350 lib/kobject.c:729 putdevice+0x1b/0x30 drivers/base/core.c:3805 ptpclockunregister+0x171/0x270 drivers/ptp/ptpclock.c:391 gemptpremove+0x4e/0x1f0 drivers/net/ethernet/cadence/macbptp.c:404 macbclose+0x1c8/0x270 drivers/net/ethernet/cadence/macbmain.c:2966 devclosemany+0x1b9/0x310 net/core/dev.c:1585 devclose net/core/dev.c:1597 [inline] devchangeflags+0x2bb/0x740 net/core/dev.c:8649 devchangefl ---truncated---
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the Linux kernel with the Cadence MACB network driver are exposed when the affected interface is present in the kernel. The issue involves the driver's PTP clock handling and the ethtool timestamp-information path.
What does an attacker need to trigger the flaw?
The reported trigger is an ethtool get_ts_info request made while the interface is present, including during a period when its PTP clock has been destroyed after interface closure. The severity vector indicates local access, low attack complexity, and low privileges are required; user interaction is not required.
Are systems affected even if the network interface is down?
Yes. The description states that get_ts_info can access the PTP clock while the interface is merely present in the kernel, rather than only while it is open. This permits access to a PTP clock that was destroyed when the interface was closed.
How can I identify the vulnerable access path?
A KASAN report may show a use-after-free read in ptp_clock_index called from gem_get_ts_info, macb_get_ts_info, and the ethtool get_ts_info handling path. The report identifies the affected source location as drivers/ptp/ptp_clock.c:426.