CVE-2026-80991: Linux Kernel PTP Clock Use-After-Free

CVE-2026-80991 Overview

CVE-2026-80991 is a use-after-free vulnerability in the Linux kernel's Renesas Ethernet AVB (ravb) driver. The flaw exists in the Precision Time Protocol (PTP) clock teardown logic. The function ravb_ptp_interrupt() can race with ravb_ptp_stop() and pass the clock pointer to ptp_clock_event() while ptp_clock_unregister() is concurrently freeing it. Exploitation requires local access and low privileges on a system using the affected Renesas Ethernet AVB hardware. Successful exploitation may lead to memory corruption, kernel crashes, or potential privilege escalation.

Critical Impact
A race condition in the ravb PTP subsystem can trigger a use-after-free on the clock pointer, enabling denial of service or memory corruption in kernel context.

Affected Products

Linux kernel builds including the Renesas Ethernet AVB (ravb) driver with PTP support
Systems using Renesas SoC Ethernet controllers with hardware timestamping enabled
Distributions shipping kernels prior to the patched stable releases referenced in the kernel commits

Discovery Timeline

2026-09-11 - CVE-2026-80991 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-80991

Vulnerability Analysis

The vulnerability resides in the Renesas Ethernet AVB driver's PTP hardware clock lifecycle handling. The interrupt handler ravb_ptp_interrupt() reads the PTP clock pointer and forwards it to ptp_clock_event() to dispatch timestamp events. In parallel, ravb_ptp_stop() invokes ptp_clock_unregister() to release the clock resource during driver teardown or interface shutdown.

Without serialization between these code paths, the interrupt handler can dereference a clock pointer that has already been freed by the unregister path. The outcome is a classic use-after-free [CWE-416] in kernel memory. Because the freed object is a PTP clock structure managed by the kernel's PTP subsystem, subsequent access can corrupt kernel data structures or lead to controlled memory reuse.

Root Cause

The root cause is missing synchronization between the interrupt-driven event delivery path and the driver teardown path. The clock pointer was accessed without atomic ordering guarantees, allowing ravb_ptp_interrupt() to observe a stale value after ravb_ptp_stop() began releasing it. The fix uses READ_ONCE() and WRITE_ONCE() for lockless access, atomically detaches the pointer with xchg() before disabling PTP interrupts, and synchronizes all IRQs before calling ptp_clock_unregister().

Attack Vector

Exploitation requires local access to a system running an affected kernel with the ravb driver bound to Renesas Ethernet AVB hardware. An attacker with the ability to trigger interface state changes concurrent with PTP interrupt activity can race the teardown path. Timing precision is needed, but repeated attempts on hardware generating frequent PTP interrupts increases the exploitation window.

No public proof-of-concept exploit is available. The vulnerability was resolved directly in mainline commits without an accompanying exploit release.

Detection Methods for CVE-2026-80991

Indicators of Compromise

Unexpected kernel oops or panic messages referencing ravb_ptp_interrupt, ptp_clock_event, or ptp_clock_unregister in dmesg output
KASAN (Kernel Address Sanitizer) reports flagging use-after-free access on PTP clock objects during interface shutdown or driver unload
Repeated crashes correlated with ip link state transitions on Renesas Ethernet AVB interfaces

Detection Strategies

Enable KASAN in test and staging kernels built for Renesas platforms to surface race-driven memory corruption before production deployment
Audit kernel version strings across fleet inventory to identify hosts running unpatched ravb driver code
Correlate kernel crash telemetry with PTP interface configuration changes to identify probable exploitation attempts

Monitoring Recommendations

Forward kernel logs from Renesas-based embedded and industrial systems to a centralized log analytics platform
Alert on kernel panics or BUG: entries containing ravb or ptp_clock symbols
Track privileged local process activity that toggles network interface state on affected hardware

How to Mitigate CVE-2026-80991

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable tree commits and rebuild affected kernels
Identify all Renesas SoC-based systems in inventory and prioritize patching based on exposure and physical access controls
Restrict local shell access on affected systems to trusted administrators until patches are deployed

Patch Information

The fix is available in the mainline and stable Linux kernel trees. Refer to the following commits for the patch series:

The patch introduces READ_ONCE() and WRITE_ONCE() for the clock pointer, uses xchg() to atomically detach it, and calls synchronize_irq() before unregistering the detached clock.

Workarounds

Disable PTP hardware timestamping on affected Renesas Ethernet AVB interfaces where the feature is not required
Avoid frequent interface bring-up and bring-down cycles on unpatched systems to reduce race exposure
Limit local user access and enforce strict privilege boundaries on embedded systems where kernel updates are delayed

bash

# Disable PTP hardware timestamping on the affected interface as a temporary mitigation
sudo ethtool -T eth0
sudo hwstamp_ctl -i eth0 -r 0 -t 0