CVE-2026-80564: Linux Kernel Use-After-Free Vulnerability

CVE-2026-80564 Overview

CVE-2026-80564 is a NULL pointer dereference vulnerability in the Linux kernel's Google Virtual Ethernet (gve) driver. The flaw stems from a missing implementation of the Precision Time Protocol (PTP) adjfine callback. A local unprivileged user can trigger the dereference by invoking clock_adjtime() against the PTP character device exposed by the driver, for example via testptp -d /dev/ptp0 -f 0. The resulting kernel oops occurs in ptp_clock_adjtime and propagates through pc_clock_adjtime and __do_sys_clock_adjtime. The issue has been resolved upstream through commits 3992ced, e9482fe, and fa9b991.

Critical Impact
Local users on affected Linux systems using the gve driver can trigger a kernel NULL pointer dereference, causing denial of service through kernel panic.

Affected Products

Linux kernel with the gve (Google Virtual Ethernet) driver enabled
Systems exposing PTP hardware clock devices (/dev/ptp*) backed by the gve driver
Google Cloud VM instances using gve virtual NICs with PTP support

Discovery Timeline

2026-08-26 - CVE-2026-80564 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-80564

Vulnerability Analysis

The gve driver registers a PTP hardware clock (PHC) with the kernel's PTP subsystem but does not implement the adjfine operation used to adjust clock frequency. When userspace calls clock_adjtime() on the exposed /dev/ptp0 device, the PTP core dispatches to ptp_clock_adjtime(), which invokes the driver-supplied adjfine function pointer without validating that it is non-NULL. Because the callback is unset, the kernel dereferences address 0x0 and oopses. The call chain observed is __do_sys_clock_adjtime → pc_clock_adjtime → ptp_clock_adjtime → NULL callback. Any user with read access to the PTP device node can reach this path, since clock_adjtime() requires only that the caller can open the clock descriptor.

Root Cause

The defect is an incomplete driver implementation. The gve driver populates its ptp_clock_info structure without providing an adjfine (or legacy adjfreq) handler. The PTP core assumes drivers that register a clock support frequency adjustment and does not guard the callback dispatch, so the missing pointer becomes a reachable NULL dereference [CWE-476].

Attack Vector

Exploitation requires local access and the ability to open the PTP character device. The reproducer uses the in-tree testptp utility: sudo ./testptp -d /dev/ptp0 -f 0. Successful triggering produces a kernel oops and, depending on kernel configuration (panic_on_oops), a full system panic. The vulnerability does not provide code execution or memory corruption primitives; the security impact is denial of service against the host kernel.

No public exploit code beyond the reproduction command sequence documented in the upstream fix is required. Refer to the kernel commit fa9b991 for the corrective patch.

Detection Methods for CVE-2026-80564

Indicators of Compromise

Kernel oops entries in dmesg or /var/log/kern.log containing BUG: kernel NULL pointer dereference with a call trace referencing ptp_clock_adjtime+ and pc_clock_adjtime+.
Unexpected reboots or kernel panics on Linux hosts using the gve driver, particularly Google Cloud Compute Engine VMs.
Audit records showing non-root processes invoking clock_adjtime() against /dev/ptp* devices.

Detection Strategies

Monitor kernel logs for the signature call trace ptp_clock_adjtime → pc_clock_adjtime → __do_sys_clock_adjtime on hosts loading the gve module.
Use auditd rules to record syscall=clock_adjtime invocations and correlate with the calling UID and target clock device.
Inventory Linux hosts and identify systems where lsmod | grep gve returns a match combined with a present /dev/ptp0 node.

Monitoring Recommendations

Forward kernel ring buffer output to a centralized log platform and alert on NULL pointer dereference events referencing PTP symbols.
Track host uptime and unplanned reboots on gve-based fleets to surface potential triggering activity.
Alert on execution of PTP tooling such as testptp, phc_ctl, or chronyd making frequency adjustments on affected kernels.

How to Mitigate CVE-2026-80564

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits 3992ced, e9482fe, and fa9b991 from your distribution's stable kernel updates.
Restrict permissions on /dev/ptp* device nodes so only trusted service accounts (for example, chrony or ptp4l) can open them.
On Google Cloud, update guest images to the latest vendor-supplied kernel that includes the gveadjfine fix.

Patch Information

The fix implements the missing adjfine callback in the gve driver so that ptp_clock_adjtime() dispatches to a valid function instead of a NULL pointer. Backports are available in the stable trees referenced by Kernel Git Commit 3992ced, Kernel Git Commit e9482fe, and Kernel Git Commit fa9b991.

Workarounds

Tighten permissions on PTP device nodes via udev rules so unprivileged users cannot open /dev/ptp0.
Where PTP is not required, blacklist or disable PTP support in the gve driver configuration to remove the exposed clock device.
Set kernel.panic_on_oops=0 only as a temporary measure to keep hosts online while patches are staged; this does not remove the underlying flaw.

bash

# Restrict access to PTP clock devices via udev
echo 'KERNEL=="ptp[0-9]*", MODE="0600", OWNER="root", GROUP="root"' \
    | sudo tee /etc/udev/rules.d/60-ptp-restrict.rules
sudo udevadm control --reload-rules
sudo udevadm trigger