HIGH Introduced in 6.13
ptp VmClock Bypass
CVE-2026-80724
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
KernelScan AI4.4MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: ptp: vmclock: prevent read-only mappings from becoming writable vmclock_miscdev_mmap() rejects writable mappings of the shared vmclock ABI page with -EROFS, but leaves VM_MAYWRITE set. Userspace can map the page read-only and then upgrade it to writable with mprotect(), after which the guest can corrupt the host-written timekeeping data (sequence counter, UTC time, TSC offset) that the vmclock ABI defines as read-only. Clear VM_MAYWRITE on the read-only path so the mapping cannot be upgraded, as i915 does for its read-only objects and as fixed in drm/vc4 (CVE-2026-68445) and drm/panthor (CVE-2024-53071).
02KernelScan AI Analysis
Risk summary
A guest VM with the vmclock device can bypass the read-only protection on the shared timekeeping page by mapping it read-only and upgrading to writable via mprotect(). This allows corruption of host-written timekeeping data, degrading the guest's clock synchronization. The vulnerability is only reachable in virtualized environments where the hypervisor exposes the vmclock device to guests.
Vulnerability analysis
The vmclock driver exposes a shared timekeeping page to userspace through a device node. When setting up the mapping, the driver blocks direct write access but accidentally leaves the path open for a later permission upgrade. A local attacker can map the page as read-only and then make it writable, allowing changes to timekeeping data that should stay read-only. This corrupts the shared information used by the guest's clock subsystem. The fix closes that path so the mapping stays permanently read-only. The flaw is only reachable inside a guest VM whose hypervisor exposes the vmclock device, and requires local access to open the device.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 6.13 | 6.18.50 | 5b4f2bec7bea |
| 7.1 | 6.13 | 7.1.11 | 3f5677d2f817 |
| 7.2 | 6.13 | 7.2.4 | 2496e1418271 |
| mainline | 6.13 | 7.3 | 2e596e7814ba |