Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2026-80724

ptp: vmclock: prevent read-only mappings from becoming writable

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: ptp: vmclock: prevent read-only mappings from becoming writable vmclock_miscdev_mmap() rejects writable mappings of the shared vmclock ABI page with -EROFS, but leaves VM_MAYWRITE set. Userspace can map the page read-only and then upgrade it to writable with mprotect(), after which the guest can corrupt the host-written timekeeping data (sequence counter, UTC time, TSC offset) that the vmclock ABI defines as read-only. Clear VM_MAYWRITE on the read-only path so the mapping cannot be upgraded, as i915 does for its read-only objects and as fixed in drm/vc4 (CVE-2026-68445) and drm/panthor (CVE-2024-53071).

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 20503272422693d793b84f88bf23fe4e955d3a33 to < 5b4f2bec7bea6c04084d720d731bedee7caf878daffected
  • 20503272422693d793b84f88bf23fe4e955d3a33 to < 3f5677d2f817355147337f0453174c7bb0f3b66aaffected
  • 20503272422693d793b84f88bf23fe4e955d3a33 to < 2496e141827102d6af512950057d402a2cfb2bfcaffected
  • 20503272422693d793b84f88bf23fe4e955d3a33 to < 2e596e7814ba38cdc129991058b6c254ed37cb11affected
  • 20503272422693d793b84f88bf23fe4e955d3a33 to < 0ce59c4148ecd1520c5592a63bb3c8991ee2d326affected
  • 20503272422693d793b84f88bf23fe4e955d3a33 to < a5edadbae57e2298a56cf7a4e774a027905a331faffected

Linux Linux

Default version status: affected

  • 6.13affected
  • 0 to < 6.13unaffected
  • 6.18.47 to ≤ 6.18.*unaffected
  • 6.18.50 to ≤ 6.18.*unaffected
  • 7.1.11 to ≤ 7.1.*unaffected
  • 7.2.1 to ≤ 7.2.*unaffected
  • 7.2.4 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References