CVE-2026-90056: net: fec: only stop PTP if it was initialized
In the Linux kernel, the following vulnerability has been resolved:
net: fec: only stop PTP if it was initialized
fecptpinit() is only called when fep->bufdescex is available. However, fecprobe() unconditionally calls fecptpstop() on the failedinit path, and fecdrvremove() unconditionally calls fecptpstop() during device removal.
Check fep->bufdescex before calling fecptpstop() in both paths to avoid stopping PTP when it was not initialized.
Event History
Frequently Asked Questions
When can the vulnerable cleanup path be reached?
It can be reached if FEC device initialization fails and follows the failed_init path, or when the FEC driver is removed. In both cases, affected code can call fec_ptp_stop() even though PTP initialization did not occur.
What condition makes a system susceptible to the incorrect PTP stop call?
The issue applies when fep->bufdesc_ex is not available. Under that condition fec_ptp_init() is not called, so PTP must not be stopped during cleanup or driver removal.
What mitigation is available if the fix cannot be applied immediately?
The provided data identifies no workaround. The correction is to guard calls to fec_ptp_stop() with a check that fep->bufdesc_ex is available.