CVE-2026-80724: Linux Kernel vmclock Privilege Escalation

CVE-2026-80724 Overview

CVE-2026-80724 is a Linux kernel vulnerability in the ptp_vmclock driver. The vmclock_miscdev_mmap() function rejects writable mappings of the shared vmclock ABI page with -EROFS but fails to clear the VM_MAYWRITE flag. Userspace can map the page read-only, then upgrade it to writable through mprotect(). A guest with local access can then corrupt host-written timekeeping data, including the sequence counter, UTC time, and TSC offset that the vmclock ABI defines as read-only.

Critical Impact
Local users can corrupt host-provided timekeeping data by bypassing the driver's read-only mapping enforcement, breaking time integrity guarantees for the guest.

Affected Products

Linux kernel with the ptp_vmclock driver
Virtualized guest environments consuming the vmclock precision time protocol ABI
Distributions shipping the affected kernel versions prior to the referenced stable commits

Discovery Timeline

2026-08-28 - CVE-2026-80724 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-80724

Vulnerability Analysis

The ptp_vmclock driver exposes a shared memory page containing timekeeping data written by the host and consumed by the guest. The vmclock ABI defines this page as read-only from the guest's perspective. The vmclock_miscdev_mmap() handler enforces this by returning -EROFS when userspace requests a mapping with VM_WRITE set.

The enforcement is incomplete. The handler leaves the VM_MAYWRITE VMA flag intact on read-only mappings. VM_MAYWRITE controls whether the kernel permits later transitions to writable through mprotect(). With the flag still set, userspace maps the page with PROT_READ, then calls mprotect() to add PROT_WRITE, obtaining a writable mapping the driver explicitly intended to forbid.

Once writable, the guest can overwrite the sequence counter, UTC time fields, and TSC offset. Readers relying on the vmclock sequence counter for consistent snapshots can observe torn or fabricated values. This is a broken access control flaw affecting kernel driver memory-mapping semantics.

Root Cause

The root cause is a missing VM_MAYWRITE clear operation on the read-only code path in vmclock_miscdev_mmap(). Similar patterns have been fixed in other subsystems, including i915, drm/vc4 (CVE-2026-68445), and drm/panthor (CVE-2024-53071). All three treat VM_MAYWRITE as the authoritative gate for future writability upgrades.

Attack Vector

An attacker with local, low-privilege access to a guest that exposes the vmclock character device opens it, invokes mmap() with PROT_READ, and then calls mprotect() to add PROT_WRITE. The resulting writable mapping targets the shared timekeeping page, allowing corruption of values the host publishes as authoritative. See the kernel stable commit a5edadb for the fix.

Detection Methods for CVE-2026-80724

Indicators of Compromise

Anomalous jumps or regressions in guest UTC time sourced from the vmclock ABI
Unexpected changes to the vmclock sequence counter that do not correspond to host updates
Processes invoking mprotect() with PROT_WRITE on file-backed mappings of the vmclock miscdevice

Detection Strategies

Audit kernel versions across virtualized fleets to identify hosts running unpatched ptp_vmclock drivers
Instrument mprotect() syscall telemetry on guests to flag write upgrades against /dev/vmclock* mappings
Correlate timekeeping anomalies with process activity accessing the vmclock character device

Monitoring Recommendations

Collect syscall auditing for openat, mmap, and mprotect targeting the vmclock miscdevice path
Monitor guest clock drift and vmclock sequence counter values against host-reported values
Alert on non-root processes performing mprotect() write upgrades on kernel-exported shared pages

How to Mitigate CVE-2026-80724

Immediate Actions Required

Apply the upstream kernel patches referenced in the stable tree for the ptp_vmclock driver
Update guest kernels across virtualized fleets to a version that clears VM_MAYWRITE in vmclock_miscdev_mmap()
Restrict access to the vmclock character device to trusted system components where feasible

Patch Information

The fix clears VM_MAYWRITE on the read-only mapping path so mprotect() cannot upgrade the mapping to writable. Patches are available in the mainline and stable trees:

Workarounds

Remove or blacklist the ptp_vmclock kernel module in guests that do not require vmclock time sourcing
Tighten filesystem permissions on the vmclock character device to limit access to privileged users only
Prefer alternate PTP sources such as ptp_kvm on guests where vmclock is not strictly required until patches land

bash

# Blacklist the ptp_vmclock module until patched kernel is deployed
echo "blacklist ptp_vmclock" | sudo tee /etc/modprobe.d/blacklist-ptp-vmclock.conf
sudo rmmod ptp_vmclock 2>/dev/null || true
sudo update-initramfs -u