CVE-2026-80992 Overview
CVE-2026-80992 is a NULL pointer dereference vulnerability in the Linux kernel's Renesas Ethernet AVB (ravb) network driver. The flaw resides in the driver's Precision Time Protocol (PTP) clock handling logic. Before the first device open, the PTP clock is unavailable, so querying its index dereferences a NULL pointer. Registration failures can additionally leave an error pointer stored in priv->ptp.clock, which is subsequently dereferenced by callers expecting a valid clock handle.
Critical Impact
A local, low-privileged user can trigger a kernel NULL or error-pointer dereference in the ravb driver, leading to a kernel oops or system crash and potential loss of network availability on affected Renesas Ethernet hardware.
Affected Products
- Linux kernel net/ravb driver (Renesas Ethernet AVB)
- Systems using Renesas SoCs with the ravb network interface
- Multiple stable Linux kernel branches, per the referenced kernel.org commits
Discovery Timeline
- 2026-09-11 - CVE-2026-80992 published to NVD
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-80992
Vulnerability Analysis
The vulnerability affects the ravb driver, which supports Renesas Ethernet AVB controllers on ARM-based SoCs. The driver integrates with the kernel PTP subsystem to provide hardware timestamping through a registered PTP hardware clock (PHC). The PHC is not initialized until the network interface is opened for the first time.
When user space queries timestamping capabilities on the interface before it has ever been opened, the driver returns the PHC index from priv->ptp.clock without validating that the pointer is non-NULL. This produces a NULL pointer dereference in kernel context. A related failure mode arises when ptp_clock_register() fails and stores an ERR_PTR value in priv->ptp.clock; subsequent dereferences treat the error value as a valid pointer.
The fix caches the PHC index in a separate field, returns -1 when no clock is registered, normalizes registration errors to NULL, and preserves the static timestamping capabilities exposed to user space.
Root Cause
The root cause is missing validation of the priv->ptp.clock pointer prior to dereference. The driver conflated "clock not yet registered" and "clock registration failed" with "clock is valid," allowing both NULL and ERR_PTR values to flow into pointer-arithmetic paths that expect a live ptp_clock structure.
Attack Vector
Exploitation requires local access with the ability to issue ioctl or ethtool queries against a ravb network interface. A low-privileged local user can invoke timestamping capability queries such as SIOCETHTOOL with ETHTOOL_GET_TS_INFO before the interface is opened, or on a system where PTP clock registration has failed, to trigger the dereference. No user interaction is required beyond the syscall itself.
No public exploit or proof-of-concept has been published for CVE-2026-80992. The vulnerability manifests as a kernel oops when the affected code path is reached. Refer to the upstream kernel commits linked in the references for the exact code paths and fix details.
Detection Methods for CVE-2026-80992
Indicators of Compromise
- Kernel oops or panic messages referencing ravb, ravb_ptp, or ptp_clock_index in dmesg or /var/log/kern.log
- Unexpected network interface reset or link loss on Renesas Ethernet AVB interfaces
- Failed ptp_clock_register() entries in kernel logs prior to a subsequent crash
Detection Strategies
- Audit kernel version and patch level on systems running Renesas SoCs to confirm whether the ravb fix commits are applied.
- Monitor dmesg output for NULL pointer dereference stack traces containing ravb_ symbols.
- Correlate ethtool timestamping capability queries with subsequent kernel error events on affected hosts.
Monitoring Recommendations
- Forward kernel logs to a centralized log platform and alert on BUG: kernel NULL pointer dereference events referencing ravb.
- Track network interface flap events on Renesas-based edge or industrial systems where uptime is critical.
- Baseline expected ethtool -T <iface> behavior and alert on unexpected failures against ravb interfaces.
How to Mitigate CVE-2026-80992
Immediate Actions Required
- Identify all Linux systems using the ravb driver by running lsmod | grep ravb or checking /sys/class/net/*/device/driver.
- Upgrade to a Linux kernel release that includes the fix commits referenced by kernel.org for this CVE.
- Restrict local access to affected systems where kernel updates cannot be applied immediately.
Patch Information
The fix has been merged into the mainline Linux kernel and backported to multiple stable branches. Relevant upstream commits include 0aaa5393, 1f77af0a, 29ffd972, 8d4d06d6, bf330841, and fc710f89. Apply the stable kernel update provided by your Linux distribution vendor once available.
Workarounds
- Where the ravb interface is not required, unload or blacklist the driver to remove the vulnerable code path.
- Limit shell and ioctl access on affected hosts to trusted administrators to reduce the pool of users capable of triggering the dereference.
- Ensure network interfaces using ravb are brought up successfully during boot so the PTP clock is registered before any user-space timestamping queries occur.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
