CVE-2026-80724: ptp: vmclock: prevent read-only mappings from becoming writable

Published Aug 28, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

ptp: vmclock: prevent read-only mappings from becoming writable

vmclockmiscdevmmap() rejects writable mappings of the shared vmclock ABI page with -EROFS, but leaves VMMAYWRITE set. Userspace can map the page read-only and then upgrade it to writable with mprotect(), after which the guest can corrupt the host-written timekeeping data (sequence counter, UTC time, TSC offset) that the vmclock ABI defines as read-only.

Clear VMMAYWRITE on the read-only path so the mapping cannot be upgraded, as i915 does for its read-only objects and as fixed in drm/vc4 (CVE-2026-68445) and drm/panthor (CVE-2024-53071).

Affected Software

1 affected component

Linux Kernel Organization Linux kernel

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade drm/vc4 to a version that resolves this vulnerability.
Patch CVE-2024-53071
Configuration
Clear VM_MAYWRITE on the read-only path so the mapping cannot be upgraded to writable (e.g., prevent userspace from obtaining writable mappings via mprotect()).
Linux kernel ptp/vmclock_miscdev_mmap() VM_MAYWRITE (for mappings on the read-only vmclock ABI page path) = cleared/removed

Event History

Aug 28, 2026

CVE Published

via MITRE·07:03 AM

Data Sourced

via MITRE·07:03 AM

Description

Frequently Asked Questions

What access is needed to exploit this issue?

An attacker needs userspace access in a guest that can map the shared vmclock ABI page. They can request a read-only mapping and then use mprotect() to upgrade it to writable.

What data could be modified through a successful exploit?

The guest could corrupt host-written vmclock timekeeping data that is defined as read-only, including the sequence counter, UTC time, and TSC offset.