Look up another CVE · open CVE-2026-80992 in the interactive tracker
CVE-2026-80992
net: ravb: avoid dereferencing an invalid PTP clock
Published 2026-09-11 (37 days ago) by the Linux kernel CNA. Subsystem drivers/net. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-80992 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4841-1 · 2026-10-17 · text | 6.1.190-1 | Update the kernel and reboot. DLA-4841-1 shipped the fix on 2026-10-17, in 6.1.190-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixedDSA-6528-1 · 2026-09-29 · text | 6.12.111-1 | Update the kernel and reboot. DSA-6528-1 shipped the fix on 2026-09-29, in 6.12.111-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4817-1 · 2026-10-04 · text | 6.12.111-1~deb12u1 | Update the kernel and reboot. DLA-4817-1 shipped the fix on 2026-10-04, in 6.12.111-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
The PTP clock is unavailable before the first open, so querying its index can dereference a NULL pointer. Registration failures can also leave an error pointer in priv->ptp.clock. Cache the PHC index separately and report -1 while no clock is registered. Normalize registration errors to NULL and preserve the static timestamping capabilities.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/net/ethernet/renesas/ravb.h
drivers/net/ethernet/renesas/ravb_main.c
drivers/net/ethernet/renesas/ravb_ptp.c
- What this is
- RENESAS ETHERNET AVB DRIVERMAINTAINERS section matched on drivers/net/ethernet/renesas/ravb* · netdev@vger.kernel.org · Maintained
- Kernel module
- ravb
Check it on the machine
grep -wE 'CONFIG_ETHERNET|CONFIG_NET_VENDOR_RENESAS|CONFIG_RAVB' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w ravbPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian does not build this code in 3 releases. It does build it in 2 releases, so the answer depends on which release the machine runs.
- bookworm, trixien
- forky, sidMnot built on amd64/amd64, amd64/cloud-amd64, amd64/rt-amd64, arm64/cloud-arm64, armhf/armmp, armhf/armmp-lpae, loong64/loong64, ppc64el/powerpc64le, ppc64el/powerpc64le-64k, riscv64/riscv64, s390x/s390x
- bookworm · linux-6.12n
- n
- not enabled on any flavour - this release does not build the code
- M
- a module where it is built at all; some flavours do not build it
- Build switches
- CONFIG_ETHERNET, CONFIG_NET_VENDOR_RENESAS, CONFIG_RAVB
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-09-11 (37 days ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.17%, higher than 5.8% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/net
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 4.2 | 6.1.188 | 29ffd972531f |
| 4.2 | 6.6.157 | bf3308416a2b |
| 4.2 | 6.12.109 | fc710f89a644 |
| 4.2 | 6.18.50 | 8d4d06d6e2b5 |
| 4.2 | 7.2.4 | 0aaa53936419 |
| 4.2 | 7.3 | 1f77af0aaf27 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4841-1 | 2026-10-17 | bookworm 6.1.190-1 | tracker |
| DLA-4817-1 | 2026-10-04 | bookworm 6.12.111-1~deb12u1 | tracker |
| DSA-6528-1 | 2026-09-29 | trixie 6.12.111-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- ravb_get_ts_info() is reached only via local SIOCETHTOOL ETHTOOL_GET_TS_INFO, ethtool netlink TSINFO_GET, SO_TIMESTAMPING BIND_PHC, or taprio setup on the ravb netdev. Received Ethernet/PTP packets never enter this path.
- AC:LAttack complexity, low
- ethtool timestamp-info on a never-opened ravb interface deterministically calls ptp_clock_index(NULL), and after a normal open/close ravb_ptp_stop() leaves a dangling priv->ptp.clock that the same query dereferences. The attacker does not need a race or a rare config.
- PR:LPrivileges required, low
- ETHTOOL_GET_TS_INFO is on the ethtool ioctl allow-list that skips CAP_NET_ADMIN, and ETHTOOL_MSG_TSINFO_GET has no GENL admin flag, so an unprivileged local user can trigger it. Interface cycling is privileged, but the down/never-opened state exists after normal system management.
- UI:NUser interaction, none
- The attacker issues the ethtool ioctl/netlink query (or SO_TIMESTAMPING BIND_PHC) directly against the existing ravb netdev. No separate victim action is required.
- S:UScope, unchanged
- The defect is in the ravb kernel Ethernet/PTP driver and impacts the same kernel. It is not a guest-to-host, IOMMU, or other cross-authority boundary bypass.
- C:HConfidentiality impact, high
- After ndo_stop, ravb_ptp_stop() unregisters and kfree's struct ptp_clock via ptp_clock_release() but leaves priv->ptp.clock set, so a later ptp_clock_index() is a kernel heap UAF read. Kernel scoring treats UAFs as high confidentiality because freed-object reuse can yield disclosure primitives.
- I:HIntegrity impact, high
- The get_ts_info hit is a stale read of ptp_clock.index, but after close the object is a freed heap ptp_clock. Kernel scoring treats that UAF as high integrity impact because heap reuse can be leveraged toward write or control-flow primitives.
- A:HAvailability impact, high
- Before first open, ptp_clock_index(NULL) oopses; a failed ptp_clock_register() leaves an ERR_PTR that is also dereferenced; and the post-close dangling pointer is a UAF that can panic. Any of these kernel crashes is high availability impact.