In the Linux kernel, the following vulnerability has been resolved:

iavf: fix PTP use-after-free during reset

Commit 7c01dbfc8a1c5f ("iavf: periodically cache PHC time") introduced a worker to cache PHC time, but failed to stop it during reset or disable.

This creates a race condition where iavfresettask() or iavfdisablevf() free adapter resources (AQ) while the worker is still running. If the worker triggers iavfqueueptpcmd() during teardown, it accesses freed memory/locks, leading to a crash.

Fix this by calling iavfptprelease() before tearing down the adapter. This ensures ptpclockunregister() synchronously cancels the worker and cleans up the chardev before the backing resources are destroyed.

iavf: fix out-of-bounds writes in iavfgetethtoolstats()