CVE-2026-80991: net: ravb: serialize PTP clock teardown
In the Linux kernel, the following vulnerability has been resolved:
net: ravb: serialize PTP clock teardown
ravbptpinterrupt() can race with ravbptpstop() and pass the clock to ptpclockevent() while ptpclockunregister() is freeing it. This can lead to a use-after-free.
Use READONCE() and WRITEONCE() for lockless access to the clock pointer. Atomically detach it with xchg() before disabling PTP interrupts, then synchronize all IRQs which can invoke ravbptpinterrupt() before unregistering the detached clock.
A handler which read the old pointer completes before the clock is unregistered, while later handlers read NULL and skip the event.
Affected Software
Event History
Frequently Asked Questions
What conditions are required for this issue to occur?
A race must occur between ravb_ptp_interrupt() handling a PTP event and ravb_ptp_stop() tearing down the PTP clock. The interrupt handler must retain or use the clock pointer while ptp_clock_unregister() is freeing that clock.
Which systems are exposed?
Systems using the Linux kernel ravb network driver with PTP clock functionality are relevant. The provided information does not identify specific hardware models, kernel versions, or configuration defaults.
How does the fix prevent the use-after-free?
The fix atomically detaches the clock pointer with xchg() before PTP interrupts are disabled, then synchronizes IRQ handlers before unregistering the detached clock. Interrupt handlers that run afterward read a NULL pointer and do not submit an event for the freed clock.