CVE-2026-80724ptp: vmclock: prevent read-only mappings from becoming writable
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: ptp: vmclock: prevent read-only mappings from becoming writable vmclock_miscdev_mmap() rejects writable mappings of the shared vmclock ABI page with -EROFS, but leaves VM_MAYWRITE set. Userspace can map the page read-only and then upgrade it to writable with mprotect(), after which the guest can corrupt the host-written timekeeping data (sequence counter, UTC time, TSC offset) that the vmclock ABI defines as read-only. Clear VM_MAYWRITE on the read-only path so the mapping cannot be upgraded, as i915 does for its read-only objects and as fixed in drm/vc4 (CVE-2026-68445) and drm/panthor (CVE-2024-53071).
- CVSS
- 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 7, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 20503272422693d793b84f88bf23fe4e955d3a33 builds before 5b4f2bec7bea6c04084d720d731bedee7caf878d; 20503272422693d793b84f88bf23fe4e955d3a33 builds before 3f5677d2f817355147337f0453174c7bb0f3b66a; 20503272422693d793b84f88bf23fe4e955d3a33 builds before 2496e141827102d6af512950057d402a2cfb2bfc; 20503272422693d793b84f88bf23fe4e955d3a33 builds before 2e596e7814ba38cdc129991058b6c254ed37cb11; 20503272422693d793b84f88bf23fe4e955d3a33 builds before 0ce59c4148ecd1520c5592a63bb3c8991ee2d326; from 20503272422693d793b84f88bf23fe4e955d3a33 before a5edadbae57e2298a56cf7a4e774a027905a331f | CNA record |
References
- https://git.kernel.org/stable/c/5b4f2bec7bea6c04084d720d731bedee7caf878d
- https://git.kernel.org/stable/c/3f5677d2f817355147337f0453174c7bb0f3b66a
- https://git.kernel.org/stable/c/2496e141827102d6af512950057d402a2cfb2bfc
- https://git.kernel.org/stable/c/2e596e7814ba38cdc129991058b6c254ed37cb11
- https://git.kernel.org/stable/c/0ce59c4148ecd1520c5592a63bb3c8991ee2d326
- https://git.kernel.org/stable/c/a5edadbae57e2298a56cf7a4e774a027905a331f
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.