CVE-2026-52971 Overview
CVE-2026-52971 is a use-after-free vulnerability in the Linux kernel's Elastic Network Adapter (ENA) driver. The flaw resides in the PTP Hardware Clock (PHC) get_timestamp code path. The vulnerability stems from checking phc->active and caching the resp pointer from ena_dev->phc.virt_addr without holding the required spinlock.
If ena_com_phc_destroy() runs between the lockless active check and the lock acquisition, it sets active=false, frees the Direct Memory Access (DMA) memory, and sets virt_addr=NULL. The get_timestamp path then dereferences a stale or NULL pointer.
Critical Impact
A race condition between PHC destruction and timestamp retrieval can cause kernel memory corruption or a NULL pointer dereference, leading to denial of service or potential privilege escalation on systems using the ENA driver.
Affected Products
- Linux kernel versions containing the ENA driver with PHC support prior to commit e42c755582f0
- Stable kernel branches fixed by commits 95e8ae9af2a6 and ca9ed40f2894
- Amazon EC2 instances and other environments using the ena network driver
Discovery Timeline
- 2026-06-24 - CVE-2026-52971 published to NVD
- 2026-06-24 - Last updated in NVD database
Technical Details for CVE-2026-52971
Vulnerability Analysis
The Linux kernel ENA driver exposes a PTP Hardware Clock interface used by network synchronization tooling. The get_timestamp routine reads a response buffer mapped through DMA at ena_dev->phc.virt_addr. Prior to the fix, the routine evaluated phc->active and copied the resp pointer before acquiring the spinlock that protects PHC state.
This ordering created a Time-of-Check Time-of-Use (TOCTOU) window. A concurrent call to ena_com_phc_destroy() could acquire the lock, set active=false, release the lock, unmap and free the DMA buffer, and then set virt_addr=NULL. The original thread, holding a stale resp pointer, would then dereference freed memory inside the critical section.
The upstream fix moves both the active check and the resp pointer assignment to after the spinlock is acquired. With both operations serialized under the lock, the destroy path cannot free the buffer while get_timestamp is using it.
Root Cause
The root cause is improper synchronization between a resource lifecycle operation (ena_com_phc_destroy) and a resource consumer (get_timestamp). The consumer evaluated state and cached a pointer outside the lock that the producer used to gate destruction.
Attack Vector
Triggering the race requires concurrent execution of the PHC destroy path and the timestamp read path on the ENA device. This typically occurs during driver teardown, device reset, or hot-unplug while a userspace process is actively reading PTP timestamps through the /dev/ptp* interface. Successful exploitation depends on precise timing of the two kernel paths.
No public proof-of-concept code is available. The vulnerability is described in the upstream kernel commits referenced below.
Detection Methods for CVE-2026-52971
Indicators of Compromise
- Kernel oops or panic messages referencing ena_phc_get_timestamp or ena_com_phc_get
- NULL pointer dereference traces involving the ena module during device teardown or reset events
- KASAN use-after-free reports against the PHC DMA buffer on kernels with sanitizers enabled
Detection Strategies
- Audit running kernel versions across Linux fleets and compare against the patched commits 95e8ae9af2a6, ca9ed40f2894, and e42c755582f0
- Correlate dmesg output and crash dumps containing ENA driver symbols with concurrent PTP client activity
- Monitor host telemetry for unexpected kernel crashes on EC2 or other instances using the ena driver
Monitoring Recommendations
- Forward kernel.crash and kernel.emerg syslog facilities to centralized logging for analysis
- Track ENA driver reset events through ethtool -S counters and link state transitions
- Alert on processes that repeatedly open /dev/ptp* devices coinciding with ENA module reload events
How to Mitigate CVE-2026-52971
Immediate Actions Required
- Inventory all Linux hosts running the ena network driver with PHC enabled
- Schedule kernel updates to a version that includes the upstream fix commits
- For cloud workloads on Amazon EC2, apply vendor-provided kernel updates from your distribution
Patch Information
The vulnerability is resolved by three upstream kernel commits that reorder the phc->active check and resp pointer assignment to occur under the spinlock. Refer to Kernel Commit 95e8ae9, Kernel Commit ca9ed40, and Kernel Commit e42c755 for the source-level changes.
Workarounds
- Disable PHC functionality on the ENA driver if supported by your kernel build, removing the vulnerable code path
- Avoid driver teardown or reset operations while userspace PTP clients are active on the affected interface
- Restrict access to /dev/ptp* devices to trusted processes to reduce the population of code paths capable of racing the destroy operation
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
