CVE-2026-90100: ptp: netc: fix period truncation and potential divide-by-zero in PEROUT

Published Sep 17, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

ptp: netc: fix period truncation and potential divide-by-zero in PEROUT

The maxperiod bound in nettimerenableperout() was computed as:

maxperiod = (u64)NETCTMRDEFAULTFIPER + integralperiod;

which exceeds U32MAX when integralperiod > 0 (e.g. 0x100000002 for the default 333333333 Hz clock). A periodns that passes this check but exceeds U32MAX is then silently truncated when stored into the u32 struct netcpp::period field.

A truncated value of zero can reach netctimersetperoutalarm(), where the local u32 period variable would also be 0, causing a divide-by-zero in roundupu64(delta, period) whenever the stime < mintime branch is taken (which always happens for a start time of {0, 0}).

Additionally, netctimerenableperiodicpulse() and netctimerenablefiper() both compute:

fiper = pp->period - integralperiod;

A zero pp->period results in an unsigned wraparound to 0xFFFFFFFD, mis-programming the FIPER hardware register.

Fix all three issues by capping maxperiod at NETCTMRDEFAULTFIPER (0xFFFFFFFF). This ensures that any periodns passing the range check fits in a u32 without truncation, so the stored value is always valid and non-zero. The accepted range is reduced by integralperiod ns (typically only a few nanoseconds), which is negligible in practice.

Affected Software

1 affected component
Linux Linux kernel

Event History

Sep 17, 2026
CVE Published
via MITRE·04:06 PM
Data Sourced
via MITRE·04:06 PM
Description

Frequently Asked Questions

1

Which systems are exposed to this issue?

Systems using the Linux kernel NETC timer PTP PEROUT functionality are exposed when a requested period passes the faulty range check while exceeding U32_MAX. The condition is possible with the default 333333333 Hz clock because the computed maximum period can exceed U32_MAX.

2

What is required to trigger the divide-by-zero condition?

A period value that is truncated to zero when stored in the u32 period field must reach the PEROUT alarm setup path. The divide-by-zero occurs when the start time is below min_time; a start time of {0, 0} always takes that branch.

3

What other impact can a zero truncated period have?

Periodic-pulse and FIPER setup subtract the integral period from the zero value as an unsigned operation, wrapping to 0xFFFFFFFD. This can mis-program the FIPER hardware register.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203