CVE-2026-64162: idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init()
In the Linux kernel, the following vulnerability has been resolved:
idpf: fix readdevclklock spinlock init in idpfptpinit()
In idpfptpinit(), readdevclklock is initialized after ptpscheduleworker() had already been called (and after idpfptpsettime64() could reach the lock). The PTP aux worker fires immediately upon scheduling and can call into idpfptpreadsrcclkregdirect(), which takes spinlock(&ptp->readdevclklock) on an uninitialized lock, triggering the lockdep "non-static key" warning:
[12973.796587] idpf 0000:83:00.0: Device HW Reset initiated [12974.094507] INFO: trying to register non-static key. ... [12974.097208] Call Trace: [12974.097213] <TASK> [12974.097218] dumpstacklvl+0x93/0xe0 [12974.097234] registerlockclass+0x4c4/0x4e0 [12974.097249] ? lockacquire+0x427/0x2290 [12974.097259] lockacquire+0x98/0x2290 [12974.097272] lockacquire+0xc6/0x310 [12974.097281] ? idpfptpreadsrcclkreg+0xb7/0x150 [idpf] [12974.097311] ? lockdephardirqsonprepare+0xde/0x190 [12974.097318] ? finishtaskswitch.isra.0+0xd2/0x350 [12974.097330] ? pfxptpauxkworker+0x10/0x10 [ptp] [12974.097343] rawspinlock+0x30/0x40 [12974.097353] ? idpfptpreadsrcclkreg+0xb7/0x150 [idpf] [12974.097373] idpfptpreadsrcclkreg+0xb7/0x150 [idpf] [12974.097391] ? kthreadworkerfn+0x88/0x3d0 [12974.097404] ? kthreadworkerfn+0x4e/0x3d0 [12974.097411] idpfptpupdatecachedphctime+0x26/0x120 [idpf] [12974.097428] ? rawspinunlockirq+0x28/0x50 [12974.097436] idpfptpdoauxwork+0x15/0x20 [idpf] [12974.097454] ptpauxkworker+0x20/0x40 [ptp] [12974.097464] kthreadworkerfn+0xd5/0x3d0 [12974.097474] ? pfxkthreadworkerfn+0x10/0x10 [12974.097482] kthread+0xf4/0x130 [12974.097489] ? pfxkthread+0x10/0x10 [12974.097498] retfromfork+0x32c/0x410 [12974.097512] ? pfxkthread+0x10/0x10 [12974.097519] retfromforkasm+0x1a/0x30 [12974.097540] </TASK>
Move the call to spinlockinit() up a bit to make sure readdevclklock is not touched before it's been initialized.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Move the call to spin_lock_init() earlier in idpf_ptp_init() so read_dev_clk_lock is initialized before the PTP auxiliary worker can invoke idpf_ptp_read_src_clk_reg_direct().
Linux kernel idpf PTP driver read_dev_clk_lock initialization order = Initialize with spin_lock_init() before ptp_schedule_worker()
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64162?
CVE-2026-64162 has a severity rating of 10, indicating a critical vulnerability.
How do I fix CVE-2026-64162?
To resolve CVE-2026-64162, you should update your Linux kernel to the latest version that includes the patch for this vulnerability.
What type of software is affected by CVE-2026-64162?
CVE-2026-64162 affects the Linux kernel, specifically related to the idpf module.
What is the nature of the vulnerability in CVE-2026-64162?
The vulnerability in CVE-2026-64162 involves improper initialization of a spinlock, potentially leading to race conditions.
When was CVE-2026-64162 published?
CVE-2026-64162 was published on July 19, 2026.