CVE-2026-80991: net: ravb: serialize PTP clock teardown
In the Linux kernel, the following vulnerability has been resolved:
net: ravb: serialize PTP clock teardown
ravbptpinterrupt() can race with ravbptpstop() and pass the clock to ptpclockevent() while ptpclockunregister() is freeing it. This can lead to a use-after-free.
Use READONCE() and WRITEONCE() for lockless access to the clock pointer. Atomically detach it with xchg() before disabling PTP interrupts, then synchronize all IRQs which can invoke ravbptpinterrupt() before unregistering the detached clock.
A handler which read the old pointer completes before the clock is unregistered, while later handlers read NULL and skip the event.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.111-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.6-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.111-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.109 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.50 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.4 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In ravb PTP clock teardown, use xchg() to atomically detach the clock pointer before disabling PTP interrupts; use READ_ONCE() and WRITE_ONCE() for lockless pointer access; synchronize all IRQs that can invoke ravb_ptp_interrupt() before calling ptp_clock_unregister() on the detached clock.
Event History
Frequently Asked Questions
What conditions are required for this issue to occur?
A race must occur between ravb_ptp_interrupt() handling a PTP event and ravb_ptp_stop() tearing down the PTP clock. The interrupt handler must retain or use the clock pointer while ptp_clock_unregister() is freeing that clock.
Which systems are exposed?
Systems using the Linux kernel ravb network driver with PTP clock functionality are relevant. The provided information does not identify specific hardware models, kernel versions, or configuration defaults.
How does the fix prevent the use-after-free?
The fix atomically detaches the clock pointer with xchg() before PTP interrupts are disabled, then synchronizes IRQ handlers before unregistering the detached clock. Interrupt handlers that run afterward read a NULL pointer and do not submit an event for the freed clock.