Executive brief
A vulnerability was identified in the Linux kernel's Precision Time Protocol (PTP) driver for Open Compute Project (OCP) hardware. When the driver is removed or detached, it incorrectly frees system resources before unregistering the clock, which can lead to a system crash or unpredictable behavior. This issue primarily affects systems using specialized OCP time-synchronization hardware during maintenance or driver updates.
Technical details
A use-after-free (UAF) vulnerability exists in drivers/ptp/ptp_ocp.c within the Linux kernel. The root cause is an incorrect resource cleanup sequence in ptp_ocp_detach(), where pin resources are freed before ptp_clock_unregister() is called. Because ptp_clock_unregister() triggers ptp_disable_all_events(), which attempts to access the already-freed pin configuration, a UAF occurs. Additionally, the fix introduces synchronize_irq() to ensure no interrupt handlers are executing on other cores during the unregistration process. The vulnerability is reachable during driver detachment or module removal. Patches have been merged into stable branches to reorder the cleanup calls and properly disable hardware interrupts before unregistering the device.
Affected products
- Linux Linux Kernel 6.18, 7.0.13, 7.1
Timeline
- 2026-06-08: other: Patch authored
- 2026-06-25: disclosed: CVE published