GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-80992 (GCVE-0-2026-80992)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:42 – Updated: 2026-09-14 11:59
VLAI
Title
net: ravb: avoid dereferencing an invalid PTP clock
Summary
In the Linux kernel, the following vulnerability has been resolved: net: ravb: avoid dereferencing an invalid PTP clock The PTP clock is unavailable before the first open, so querying its index can dereference a NULL pointer. Registration failures can also leave an error pointer in priv->ptp.clock. Cache the PHC index separately and report -1 while no clock is registered. Normalize registration errors to NULL and preserve the static timestamping capabilities.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: a0d2f20650e81407d8e51ad2cbdc492861c74e9c , < 29ffd972531f8e6e0edf4ea3496190acff9fc9c2 (git)
Affected: a0d2f20650e81407d8e51ad2cbdc492861c74e9c , < bf3308416a2be85dcc9965b614a745b40beeff14 (git)
Affected: a0d2f20650e81407d8e51ad2cbdc492861c74e9c , < fc710f89a644e030a7ca15343176ca862fd61b9d (git)
Affected: a0d2f20650e81407d8e51ad2cbdc492861c74e9c , < 8d4d06d6e2b501cb8e30ed3b1924c470358e8052 (git)
Affected: a0d2f20650e81407d8e51ad2cbdc492861c74e9c , < 0aaa53936419cf0c19c670387fc6d431e042a1b6 (git)
Affected: a0d2f20650e81407d8e51ad2cbdc492861c74e9c , < 1f77af0aaf277413ff32f6ff8c2c4282bd64c897 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.2
Unaffected: 0 , < 4.2 (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/renesas/ravb.h",
            "drivers/net/ethernet/renesas/ravb_main.c",
            "drivers/net/ethernet/renesas/ravb_ptp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "29ffd972531f8e6e0edf4ea3496190acff9fc9c2",
              "status": "affected",
              "version": "a0d2f20650e81407d8e51ad2cbdc492861c74e9c",
              "versionType": "git"
            },
            {
              "lessThan": "bf3308416a2be85dcc9965b614a745b40beeff14",
              "status": "affected",
              "version": "a0d2f20650e81407d8e51ad2cbdc492861c74e9c",
              "versionType": "git"
            },
            {
              "lessThan": "fc710f89a644e030a7ca15343176ca862fd61b9d",
              "status": "affected",
              "version": "a0d2f20650e81407d8e51ad2cbdc492861c74e9c",
              "versionType": "git"
            },
            {
              "lessThan": "8d4d06d6e2b501cb8e30ed3b1924c470358e8052",
              "status": "affected",
              "version": "a0d2f20650e81407d8e51ad2cbdc492861c74e9c",
              "versionType": "git"
            },
            {
              "lessThan": "0aaa53936419cf0c19c670387fc6d431e042a1b6",
              "status": "affected",
              "version": "a0d2f20650e81407d8e51ad2cbdc492861c74e9c",
              "versionType": "git"
            },
            {
              "lessThan": "1f77af0aaf277413ff32f6ff8c2c4282bd64c897",
              "status": "affected",
              "version": "a0d2f20650e81407d8e51ad2cbdc492861c74e9c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/renesas/ravb.h",
            "drivers/net/ethernet/renesas/ravb_main.c",
            "drivers/net/ethernet/renesas/ravb_ptp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.2"
            },
            {
              "lessThan": "4.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ravb: avoid dereferencing an invalid PTP clock\n\nThe PTP clock is unavailable before the first open, so querying its\nindex can dereference a NULL pointer. Registration failures can also\nleave an error pointer in priv-\u003eptp.clock.\n\nCache the PHC index separately and report -1 while no clock is\nregistered. Normalize registration errors to NULL and preserve the\nstatic timestamping capabilities."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - ravb_get_ts_info() is reached only via local SIOCETHTOOL ETHTOOL_GET_TS_INFO, ethtool netlink TSINFO_GET, SO_TIMESTAMPING BIND_PHC, or taprio setup on the ravb netdev. Received Ethernet/PTP packets never enter this path.\nAC:L - ethtool timestamp-info on a never-opened ravb interface deterministically calls ptp_clock_index(NULL), and after a normal open/close ravb_ptp_stop() leaves a dangling priv-\u003eptp.clock that the same query dereferences. The attacker does not need a race or a rare config.\nPR:L - ETHTOOL_GET_TS_INFO is on the ethtool ioctl allow-list that skips CAP_NET_ADMIN, and ETHTOOL_MSG_TSINFO_GET has no GENL admin flag, so an unprivileged local user can trigger it. Interface cycling is privileged, but the down/never-opened state exists after normal system management.\nUI:N - The attacker issues the ethtool ioctl/netlink query (or SO_TIMESTAMPING BIND_PHC) directly against the existing ravb netdev. No separate victim action is required.\nS:U - The defect is in the ravb kernel Ethernet/PTP driver and impacts the same kernel. It is not a guest-to-host, IOMMU, or other cross-authority boundary bypass.\nC:H - After ndo_stop, ravb_ptp_stop() unregisters and kfree\u0027s struct ptp_clock via ptp_clock_release() but leaves priv-\u003eptp.clock set, so a later ptp_clock_index() is a kernel heap UAF read. Kernel scoring treats UAFs as high confidentiality because freed-object reuse can yield disclosure primitives.\nI:H - The get_ts_info hit is a stale read of ptp_clock.index, but after close the object is a freed heap ptp_clock. Kernel scoring treats that UAF as high integrity impact because heap reuse can be leveraged toward write or control-flow primitives.\nA:H - Before first open, ptp_clock_index(NULL) oopses; a failed ptp_clock_register() leaves an ERR_PTR that is also dereferenced; and the post-close dangling pointer is a UAF that can panic. Any of these kernel crashes is high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T11:59:33.146Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/29ffd972531f8e6e0edf4ea3496190acff9fc9c2"
        },
        {
          "url": "https://git.kernel.org/stable/c/bf3308416a2be85dcc9965b614a745b40beeff14"
        },
        {
          "url": "https://git.kernel.org/stable/c/fc710f89a644e030a7ca15343176ca862fd61b9d"
        },
        {
          "url": "https://git.kernel.org/stable/c/8d4d06d6e2b501cb8e30ed3b1924c470358e8052"
        },
        {
          "url": "https://git.kernel.org/stable/c/0aaa53936419cf0c19c670387fc6d431e042a1b6"
        },
        {
          "url": "https://git.kernel.org/stable/c/1f77af0aaf277413ff32f6ff8c2c4282bd64c897"
        }
      ],
      "title": "net: ravb: avoid dereferencing an invalid PTP clock",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80992",
    "datePublished": "2026-09-11T19:42:48.855Z",
    "dateReserved": "2026-08-26T14:34:25.811Z",
    "dateUpdated": "2026-09-14T11:59:33.146Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80992",
      "date": "2026-09-17",
      "epss": "0.00164",
      "percentile": "0.06025"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/renesas/ravb.h",
                  "drivers/net/ethernet/renesas/ravb_main.c",
                  "drivers/net/ethernet/renesas/ravb_ptp.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "29ffd972531f8e6e0edf4ea3496190acff9fc9c2",
                    "status": "affected",
                    "version": "a0d2f20650e81407d8e51ad2cbdc492861c74e9c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bf3308416a2be85dcc9965b614a745b40beeff14",
                    "status": "affected",
                    "version": "a0d2f20650e81407d8e51ad2cbdc492861c74e9c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fc710f89a644e030a7ca15343176ca862fd61b9d",
                    "status": "affected",
                    "version": "a0d2f20650e81407d8e51ad2cbdc492861c74e9c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8d4d06d6e2b501cb8e30ed3b1924c470358e8052",
                    "status": "affected",
                    "version": "a0d2f20650e81407d8e51ad2cbdc492861c74e9c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0aaa53936419cf0c19c670387fc6d431e042a1b6",
                    "status": "affected",
                    "version": "a0d2f20650e81407d8e51ad2cbdc492861c74e9c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1f77af0aaf277413ff32f6ff8c2c4282bd64c897",
                    "status": "affected",
                    "version": "a0d2f20650e81407d8e51ad2cbdc492861c74e9c",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/renesas/ravb.h",
                  "drivers/net/ethernet/renesas/ravb_main.c",
                  "drivers/net/ethernet/renesas/ravb_ptp.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.2"
                  },
                  {
                    "lessThan": "4.2",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.188",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.109",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.50",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ravb: avoid dereferencing an invalid PTP clock\n\nThe PTP clock is unavailable before the first open, so querying its\nindex can dereference a NULL pointer. Registration failures can also\nleave an error pointer in priv-\u003eptp.clock.\n\nCache the PHC index separately and report -1 while no clock is\nregistered. Normalize registration errors to NULL and preserve the\nstatic timestamping capabilities."
          }
        ],
        "id": "CVE-2026-80992",
        "lastModified": "2026-09-14T13:18:53.900",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-11T20:19:06.110",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0aaa53936419cf0c19c670387fc6d431e042a1b6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1f77af0aaf277413ff32f6ff8c2c4282bd64c897"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/29ffd972531f8e6e0edf4ea3496190acff9fc9c2"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8d4d06d6e2b501cb8e30ed3b1924c470358e8052"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/bf3308416a2be85dcc9965b614a745b40beeff14"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/fc710f89a644e030a7ca15343176ca862fd61b9d"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-14T17:36:38+00:00",
      "cve": "CVE-2026-80992",
      "id": "CVE-2026-80992",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_not_affected": "276",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: ravb: avoid dereferencing an invalid PTP clock",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80992.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:04:31Z",
      "cve": "CVE-2026-80992",
      "id": "CVE-2026-80992",
      "initial_release_date": "2026-09-12T16:36:04Z",
      "product_status:known_affected": "349",
      "product_status:known_not_affected": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80992",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80992.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.