Executive brief
The Linux kernel's DSA network driver for the SJA1105 switch contains a division by zero vulnerability in the PTP (Precision Time Protocol) pin output configuration. When a user provides very small period values for PTP clock pins, rounding errors can result in a zero duration being passed to a calculation, causing a kernel crash that disables the affected network switch functionality.
Technical details
The vulnerability exists in the SJA1105 DSA driver's PTP perout pin duration handling (sja1105_ptp.c). The pin_duration parameter is converted from user-provided nanosecond values to SJA1105 clock ticks via the ns_to_sja1105_ticks() function. When very small period values are provided, this conversion can result in zero, which is then passed to future_base_time() as the cycle_time argument, triggering a division by zero. The attack vector requires local unprivileged access to invoke the PTP clock configuration interface. The fix rounds the zero result up to 1 tick using max_t(u64, ..., 1), ensuring the minimum non-zero hardware duration is used instead of zero.
Affected products
- Linux Linux kernel All versions with the vulnerable sja1105_per_out_enable() function (affected since commit 747e5eb31d59)
Timeline
- 2026-08-15: disclosed: CVE-2026-72414 published