In the Linux kernel, the following vulnerability has been resolved:
net: ravb: serialize PTP clock teardown
ravb_ptp_interrupt() can race with ravb_ptp_stop() and pass the clock to
ptp_clock_event() while ptp_clock_unregister() is freeing it. This can
lead to a use-after-free.
Use READ_ONCE() and WRITE_ONCE() for lockless access to the clock pointer.
Atomically detach it with xchg() before disabling PTP interrupts, then
synchronize all IRQs which can invoke ravb_ptp_interrupt() before
unregistering the detached clock.
A handler which read the old pointer completes before the clock is
unregistered, while later handlers read NULL and skip the event.
References
Configurations
No configuration.
History
No history.
Information
Published : 2026-09-11 20:19
Updated : 2026-09-13 07:17
NVD link : CVE-2026-80991
Mitre link : CVE-2026-80991
CVE.ORG link : CVE-2026-80991
JSON object : View
Products Affected
No product.
CWE
No CWE.