Executive brief
A vulnerability exists in the Linux kernel's macb network driver, which is used for certain Ethernet controllers. A local attacker could potentially cause a system crash or execute unauthorized code by accessing time-stamping information after the network interface has been closed. This issue stems from the system incorrectly maintaining a reference to a clock component that has already been deleted.
Technical details
A use-after-free (UAF) vulnerability exists in the macb (Cadence GEM) Ethernet driver within the Linux kernel. The PTP (Precision Time Protocol) clock is registered when the interface opens and unregistered when it closes; however, the driver failed to nullify the clock pointer after unregistration. A local attacker can trigger a UAF by calling 'get_ts_info' via ethtool (ioctl) while the interface is present but closed, leading to a read of a freed 'ptp_clock' structure. This can result in a kernel panic (DoS) or potentially arbitrary code execution. Patches have been released across multiple stable kernel branches to set the PTP clock pointer to NULL after unregistering.
Affected products
- Linux Linux Kernel 5.11 to 5.15.203, 5.16 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.78, 6.13 to 6.18.20
Timeline
- 2026-03-16: disclosed: Initial patch submitted by Fedor Pchelkin
- 2026-03-25: patched: Patch committed to stable trees by Greg Kroah-Hartman
- 2026-04-03: advisory
References
- https://git.kernel.org/stable/c/0bb848d8c64938024e45780f8032f1f67d3a3607
- https://git.kernel.org/stable/c/1f4714065b2bcbb0a4013fd355b84b848e6cc345
- https://git.kernel.org/stable/c/341d01087f821aa0f165fb1ffc8bfe4e50776da7
- https://git.kernel.org/stable/c/5653af416a48f6c18f9626ae9df96f814f45ff34
- https://git.kernel.org/stable/c/6b757f345eeea87ed5d8afd6de35b927a1a57a2f
- https://git.kernel.org/stable/c/8820ffe0975fd2efbe50453e9179c8e1c33a13d3
- https://git.kernel.org/stable/c/8da13e6d63c1a97f7302d342c89c4a56a55c7015