In the Linux kernel, the following vulnerability has been resolved:
net: ena: PHC: Check return code before setting timestamp output
ena_phc_gettimex64() is setting the output parameter regardless
of whether ena_com_phc_get_timestamp() succeeded or failed.
When ena_com_phc_get_timestamp() returns an error, the timestamp
parameter may contain uninitialized stack memory (e.g., when PHC is
disabled or in blocked state) or invalid hardware values. Passing
these to userspace via the PTP ioctl is both a security issue
(information leak) and a correctness bug.
Fix by checking the return code after releasing the lock and only
setting the output timestamp on success.
References
Configurations
Configuration 1 (hide)
|
History
12 Nov 2026, 19:59
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-667 | |
| References | () https://git.kernel.org/stable/c/24a08d7d6218d60c033015cf4870b6096446e734 - Patch | |
| References | () https://git.kernel.org/stable/c/bddf59818ae5102e6d82a4dae5add6df8da38fb0 - Patch | |
| References | () https://git.kernel.org/stable/c/edcb049d836e175e7b3d5e0d05657104545b5e65 - Patch | |
| First Time |
Linux linux Kernel
Linux |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* |
Information
Published : 2026-07-19 15:16
Updated : 2026-11-12 19:59
NVD link : CVE-2026-63837
Mitre link : CVE-2026-63837
CVE.ORG link : CVE-2026-63837
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-667
Improper Locking