Executive brief
The Linux kernel's PTP over Ethernet clock (ptp_ocp) driver reads a 13-byte board ID from device EEPROM without ensuring proper null termination. A local attacker or malicious device firmware could craft an unterminated EEPROM field that causes the driver to read beyond allocated memory, leading to information disclosure of kernel memory or denial of service.
Technical details
The vulnerability is an out-of-bounds read in the ptp_ocp driver's devlink_info_get function. The EEPROM board ID is a fixed 13-byte field that is not guaranteed to contain a NUL terminator; passing it directly to devlink_info_version_fixed_put() treats it as a C string and scans memory until a terminator is found, potentially reading beyond the allocated field. The fix uses snprintf() with a precision limit (%.13s) to safely copy at most OCP_BOARD_ID_LEN bytes into a local buffer before passing it to the devlink function. An attacker with local access to a system using this driver, or a malicious EEPROM, could trigger the over-read to leak kernel memory or crash the system. The patch was committed upstream and backported to stable kernel branches.
Affected products
- Linux Linux kernel various kernel versions prior to the fix (commit 6b69f2ef10cdb018c0b127a7cab88e590bbddba4)
Timeline
- 2026-08-22: disclosed
- 2026-08-19: patched