CVE-2026-63837: net: ena: PHC: Check return code before setting timestamp output
In the Linux kernel, the following vulnerability has been resolved:
net: ena: PHC: Check return code before setting timestamp output
enaphcgettimex64() is setting the output parameter regardless of whether enacomphcgettimestamp() succeeded or failed.
When enacomphcgettimestamp() returns an error, the timestamp parameter may contain uninitialized stack memory (e.g., when PHC is disabled or in blocked state) or invalid hardware values. Passing these to userspace via the PTP ioctl is both a security issue (information leak) and a correctness bug.
Fix by checking the return code after releasing the lock and only setting the output timestamp on success.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the Linux kernel ENA driver with PHC/PTP timestamp retrieval are exposed when the timestamp request reaches an error condition. The described examples are PHC being disabled or in a blocked state.
What does an attacker need to do to trigger the leak?
The issue is triggered through the PTP ioctl when timestamp retrieval fails. On failure, the driver can pass an uninitialized stack value or invalid hardware timestamp value to userspace.
How can I tell whether a system may be affected?
A potentially affected system uses the ENA PHC functionality and performs PTP timestamp ioctls while the PHC is disabled, blocked, or otherwise returns an error. The vulnerable behavior is setting the userspace timestamp output even when ena_com_phc_get_timestamp() fails.
What is the relevant fix behavior?
The fix checks the timestamp retrieval return code after releasing the lock and sets the output timestamp only when retrieval succeeds. This prevents failed requests from returning uninitialized or invalid timestamp data to userspace.