CVE-2026-90100: ptp: netc: fix period truncation and potential divide-by-zero in PEROUT
In the Linux kernel, the following vulnerability has been resolved:
ptp: netc: fix period truncation and potential divide-by-zero in PEROUT
The maxperiod bound in nettimerenableperout() was computed as:
maxperiod = (u64)NETCTMRDEFAULTFIPER + integralperiod;
which exceeds U32MAX when integralperiod > 0 (e.g. 0x100000002 for the default 333333333 Hz clock). A periodns that passes this check but exceeds U32MAX is then silently truncated when stored into the u32 struct netcpp::period field.
A truncated value of zero can reach netctimersetperoutalarm(), where the local u32 period variable would also be 0, causing a divide-by-zero in roundupu64(delta, period) whenever the stime < mintime branch is taken (which always happens for a start time of {0, 0}).
Additionally, netctimerenableperiodicpulse() and netctimerenablefiper() both compute:
fiper = pp->period - integralperiod;
A zero pp->period results in an unsigned wraparound to 0xFFFFFFFD, mis-programming the FIPER hardware register.
Fix all three issues by capping maxperiod at NETCTMRDEFAULTFIPER (0xFFFFFFFF). This ensures that any periodns passing the range check fits in a u32 without truncation, so the stored value is always valid and non-zero. The accepted range is reduced by integralperiod ns (typically only a few nanoseconds), which is negligible in practice.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel NETC timer PTP PEROUT functionality are exposed when a requested period passes the faulty range check while exceeding U32_MAX. The condition is possible with the default 333333333 Hz clock because the computed maximum period can exceed U32_MAX.
What is required to trigger the divide-by-zero condition?
A period value that is truncated to zero when stored in the u32 period field must reach the PEROUT alarm setup path. The divide-by-zero occurs when the start time is below min_time; a start time of {0, 0} always takes that branch.
What other impact can a zero truncated period have?
Periodic-pulse and FIPER setup subtract the integral period from the zero value as an unsigned operation, wrapping to 0xFFFFFFFD. This can mis-program the FIPER hardware register.