Executive brief
The Linux kernel's Google Virtual Ethernet (gve) driver lacks an implementation of the PTP clock adjfine function, causing it to dereference a NULL pointer when a user calls the clock adjustment system call. A local user can trigger this kernel crash, resulting in a denial of service to the affected system.
Technical details
The vulnerability is a NULL pointer dereference (CWE-476) in the gve PTP clock support code. The gve_ptp_caps structure was missing the adjfine callback function pointer, which is invoked by ptp_clock_adjtime() when a user application (such as testptp with the -f flag) attempts to adjust PTP clock frequency. The attack vector is local, requiring only user-mode access to /dev/ptp0 to trigger the crash via the clock_adjtime() syscall. The fix is trivial: implementing the gve_ptp_adjfine() stub that returns -EOPNOTSUPP (operation not supported). Patches are available in the Linux kernel stable tree as of August 2026.
Affected products
- Linux Linux kernel 5.14 and later (before patched versions)
Timeline
- 2026-08-26: disclosed: CVE-2026-80564 published
- 2026-08-11: patched: Fix committed to kernel mainline (commit 3992ced109c70b771efad9e51ae68e5c7a04dea3)
- 2026-08-23: patched: Fix included in stable kernel releases (commit e9482feeed66d4bc805458631013e9b61b1a9eaf)