Junglewise Threat Intelligence

CVE-2026-64162: Linux Kernel idpf uninitialized spinlock in idpf_ptp_init

CVE-2026-64162 · Severity: info · Published 2026-07-19

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A race condition was identified in the Linux kernel's Intel Infrastructure Data Plane Function (idpf) driver. The issue occurs during the initialization of high-precision timekeeping (PTP) features, where a security lock is accessed before it has been properly set up. While primarily resulting in system warnings or potential instability during device resets, it represents a flaw in how the system handles internal timing synchronization.

Technical details

A race condition exists in the idpf driver's PTP initialization sequence within idpf_ptp_init(). The driver calls ptp_schedule_worker() before initializing the read_dev_clk_lock spinlock. Because the PTP auxiliary worker fires immediately upon scheduling, it can invoke idpf_ptp_read_src_clk_reg_direct(), which attempts to acquire the uninitialized lock. This triggers a lockdep 'non-static key' warning and can lead to undefined behavior or kernel instability. The fix involves reordering the initialization sequence to ensure spin_lock_init() is called before the worker is scheduled or the clock is created.

Affected products

  • Linux Linux Kernel 5cb8805d2366 to eb5991d4c8ba, 3122d70b7c01, or da4f76b6a84e

Timeline

  • 2026-05-06: disclosed: Initial patch authored by Intel
  • 2026-06-01: patched: Patch committed to stable kernel trees
  • 2026-07-19: advisory: CVE published to NVD dataset

References

Related threats