CVE-2026-52971: net: ena: PHC: Fix potential use-after-free in get_timestamp
In the Linux kernel, the following vulnerability has been resolved:
net: ena: PHC: Fix potential use-after-free in gettimestamp
Move the phc->active check and resp pointer assignment to after acquiring the spinlock. Previously, phc->active was checked without holding the lock, and resp was cached from enadev->phc.virtaddr before the lock was acquired.
If enacomphcdestroy() runs between the lockless active check and the lock acquisition, it sets active=false, releases the lock, frees the DMA memory, and sets virtaddr=NULL. The gettimestamp path would then read a NULL virtaddr and dereference it.
With both the active check and the pointer read under the lock, destroy cannot free the memory while gettimestamp is using it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In the ena PHC get_timestamp path, acquire the spinlock before checking phc->active and assigning the resp pointer; perform both operations while holding the lock so ena_com_phc_destroy() cannot free the DMA memory concurrently.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-52971?
CVE-2026-52971 has a risk rating of 34, indicating a moderate level of severity.
What does CVE-2026-52971 involve?
CVE-2026-52971 involves a potential use-after-free vulnerability in the get_timestamp function of the Linux kernel.
How can CVE-2026-52971 be exploited?
CVE-2026-52971 can potentially be exploited if the phc->active check is performed without proper locking, leading to use-after-free vulnerabilities.
How do I fix CVE-2026-52971?
To fix CVE-2026-52971, ensure that the phc->active check and resp pointer assignment are performed after acquiring the spinlock.
In which versions of the Linux kernel is CVE-2026-52971 a concern?
CVE-2026-52971 is a concern in affected versions of the Linux kernel utilizing the ena driver.