FKIE_CVE-2026-97963

Vulnerability from fkie_nvd - Published: 2026-09-25 11:17 - Updated: 2026-09-25 11:17
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: net: stmmac: initialize ptp_lock at probe time priv->ptp_lock is only initialized in stmmac_ptp_register(), which runs during __stmmac_open(). However, the lock is also used while the interface is down and has never been opened: tc_taprio_configure() invokes the PTP gettime64() callback to compute the EST base time when offloading a TAPRIO schedule, and stmmac_get_time() takes priv->ptp_lock. Using an uninitialized rwlock is undefined behaviour. Move the rwlock_init() to __stmmac_dvr_probe(), together with the other private locks, so that ptp_lock is always valid regardless of the interface state.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/0338c68e22abd2ee509ec2e32508a50896618c32
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/25cc0096efba83b4e0e6fa50f03e9543b41e9d3d
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/420315413b29635de1d4ea4142e410e6465260f3
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b1986595cf827c38ff929e22fbc9ca8f76379306
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/stmicro/stmmac/stmmac_main.c",
            "drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "420315413b29635de1d4ea4142e410e6465260f3",
              "status": "affected",
              "version": "b60189e0392fa06348911077ef281eb2b1047b6a",
              "versionType": "git"
            },
            {
              "lessThan": "25cc0096efba83b4e0e6fa50f03e9543b41e9d3d",
              "status": "affected",
              "version": "b60189e0392fa06348911077ef281eb2b1047b6a",
              "versionType": "git"
            },
            {
              "lessThan": "b1986595cf827c38ff929e22fbc9ca8f76379306",
              "status": "affected",
              "version": "b60189e0392fa06348911077ef281eb2b1047b6a",
              "versionType": "git"
            },
            {
              "lessThan": "0338c68e22abd2ee509ec2e32508a50896618c32",
              "status": "affected",
              "version": "b60189e0392fa06348911077ef281eb2b1047b6a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/stmicro/stmmac/stmmac_main.c",
            "drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.6"
            },
            {
              "lessThan": "5.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: initialize ptp_lock at probe time\n\npriv-\u003eptp_lock is only initialized in stmmac_ptp_register(), which runs\nduring __stmmac_open(). However, the lock is also used while the\ninterface is down and has never been opened: tc_taprio_configure()\ninvokes the PTP gettime64() callback to compute the EST base time when\noffloading a TAPRIO schedule, and stmmac_get_time() takes\npriv-\u003eptp_lock. Using an uninitialized rwlock is undefined behaviour.\nMove the rwlock_init() to __stmmac_dvr_probe(), together with the other\nprivate locks, so that ptp_lock is always valid regardless of the\ninterface state."
    }
  ],
  "id": "CVE-2026-97963",
  "lastModified": "2026-09-25T11:17:24.080",
  "metrics": {},
  "published": "2026-09-25T11:17:24.080",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/0338c68e22abd2ee509ec2e32508a50896618c32"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/25cc0096efba83b4e0e6fa50f03e9543b41e9d3d"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/420315413b29635de1d4ea4142e410e6465260f3"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/b1986595cf827c38ff929e22fbc9ca8f76379306"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.