CVE-2026-53222: ptp: ocp: fix resource freeing order
In the Linux kernel, the following vulnerability has been resolved:
ptp: ocp: fix resource freeing order
Commit a60fc3294a37 ("ptp: rework ptpclockunregister() to disable events") added a call to ptpdisableallevents() which changes the configuration of pins if they support EXTTS events. In ptpocpdetach() pins resources are freed before ptpclockunregister() and it leads to use-after-free during driver removal. Fix it by changing the order of free/unregister calls. To avoid irq handler running on the other core while ptp device unregistering, call synchronizeirq() after HW is configured to stop producing irqs and no irqs are in-flight.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
During driver removal in ptp_ocp_detach(), after hardware has stopped producing IRQs, call synchronize_irq() to ensure no IRQ handlers are in-flight before continuing device unregister/free operations.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel ptp_ocp driver are affected. The flaw is triggered during removal or detachment of the PTP OCP device, rather than by general use of every Linux kernel system.
What level of access does an attacker need?
The CVSS vector indicates local access and low privileges are required, with no user interaction. The reported impact is denial of service through a use-after-free condition during driver removal.
What can be done if the fix cannot be applied immediately?
The provided information identifies driver removal or detachment as the vulnerable operation. Avoiding removal of devices using the ptp_ocp driver reduces exposure until a kernel version containing the referenced fix is deployed.
How can administrators determine whether a system may be affected?
Check whether the running kernel uses the ptp_ocp driver and whether the system performs PTP OCP device removal or detachment. The provided references identify commits containing the resolved change, but no affected or fixed kernel version ranges are supplied.