CVE-2026-80564: gve: fix NULL dereference due to missing ptp adjfine
In the Linux kernel, the following vulnerability has been resolved:
gve: fix NULL dereference due to missing ptp adjfine
Fix NULL dereference due to missing implementation of adjfine, which can be triggered from usermode as follows:
sudo ./testptp -d /dev/ptp0 -f 0 [ 551.943697] BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] [ 552.061946] Call Trace: [ 552.064487] <TASK> [ 552.066681] ptpclockadjtime+0x1c0/0x2c0 [ 552.070874] ? getclockdesc+0x6b/0xb0 [ 552.074825] pcclockadjtime+0x78/0xc0 [ 552.078755] dosysclockadjtime+0x85/0x110 [ 552.083293] dosyscall64+0xea/0x610
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Mitigate exploitation by preventing usermode triggering of the issue described as reachable via get_clock_desc and ptp_clock_adjtime (e.g., restrict access to /dev/ptp0 so untrusted users cannot run the shown testptp invocation).
Event History
Frequently Asked Questions
Who can trigger this issue?
A local user who can access the affected PTP clock device, such as /dev/ptp0, can trigger the NULL pointer dereference through the clock adjustment interface.
What action causes the crash?
The issue is triggered by attempting a PTP frequency adjustment when the gve driver lacks an adjfine implementation. The provided example uses testptp with the -f 0 option against /dev/ptp0.
What is the likely impact?
The kernel encounters a NULL pointer dereference in the PTP clock adjustment path, which can crash the affected kernel task or system.