HIGH Introduced in 4.2
ravb PTPClock Deref
CVE-2026-80992
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI5.4MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: net: ravb: avoid dereferencing an invalid PTP clock The PTP clock is unavailable before the first open, so querying its index can dereference a NULL pointer. Registration failures can also leave an error pointer in priv->ptp.clock. Cache the PHC index separately and report -1 while no clock is registered. Normalize registration errors to NULL and preserve the static timestamping capabilities.
02KernelScan AI Analysis
Risk summary
A local user with network administration privileges on a system with Renesas Ethernet AVB hardware can crash the kernel by querying timestamping capabilities before the device is opened or after a PTP clock registration failure. The impact is denial of service only — no data disclosure or corruption. Systems without Renesas AVB Ethernet hardware are not affected.
Vulnerability analysis
The driver handles timestamping information using a clock reference that may not be valid before the network device is first opened, or if clock setup fails. When software queries this timestamping capability, the driver can follow that invalid reference and crash the kernel. The corrected code keeps the clock identifier in its own variable that safely indicates no clock is present until registration succeeds, and treats failed registrations as absent so they are not used. A local user with network administration privileges can trigger this flaw on a system that includes the Renesas AVB Ethernet hardware.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.1 | 4.2 | 6.1.188 | 29ffd972531f |
| 6.12 | 4.2 | 6.12.109 | fc710f89a644 |
| 6.18 | 4.2 | 6.18.50 | 8d4d06d6e2b5 |
| 6.6 | 4.2 | 6.6.157 | bf3308416a2b |
| 7.2 | 4.2 | 7.2.4 | 0aaa53936419 |
| mainline | 4.2 | 7.3 | 1f77af0aaf27 |
| cip/6.1 | 4.2 | 6.1.189-cip61 | 29ffd972531f |
| cip/6.1-rt | 4.2 | 6.1.189-cip61-rt32 | 29ffd972531f |
| cip/6.12 | 4.2 | 6.12.111-cip32 | fc710f89a644 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |
| cip/6.1 | Fixed in 6.1.189-cip61 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Affected — no CIP fix yet (latest 5.10.271-cip78) |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |
| cip/4.19 | Affected — no CIP fix yet (latest 4.19.325-cip136) |
| cip/4.19-rt | Affected — no CIP fix yet (latest 4.19.325-cip136-rt50) |
| cip/4.4 | Affected — no CIP fix yet (latest 4.4.302-cip115) |
| cip/4.4-rt | Affected — no CIP fix yet (latest 4.4.302-cip115-rt63) |