Executive brief
The Linux kernel's ptp vmclock driver provides shared timekeeping data between a guest and host system in virtualized environments. A local attacker could map the read-only timekeeping page and then upgrade it to writable using mprotect(), allowing corruption of critical host-maintained timing values (sequence counter, UTC time, TSC offset). This could disrupt guest timekeeping or enable further privilege escalation within the guest.
Technical details
The vulnerability is a privilege escalation flaw in the vmclock_miscdev_mmap() function in drivers/ptp/ptp_vmclock.c. The function correctly rejects initial writable mappings with -EROFS but failed to clear the VM_MAYWRITE flag, allowing userspace to map the page read-only and then use mprotect() to upgrade it to writable. The attack requires local access to /dev/ptp_vmclock and no authentication. An attacker can corrupt the host-written timekeeping ABI data (sequence counter, UTC time, TSC offset) defined as read-only. The fix clears VM_MAYWRITE on the read-only mapping path, preventing mprotect()-based upgrade, following the pattern used in i915, drm/vc4, and drm/panthor drivers. Patches were merged to the stable kernel tree as of August 2026.
Affected products
- Linux Linux kernel 5.10 and later prior to patched versions
Timeline
- 2026-08-28: disclosed
- 2026-08-27: patched: Patch merged to stable tree (commit 2496e141827102d6af512950057d402a2cfb2bfc)
- 2026-08-13: other: Patch authored (commit a5edadbae57e2298a56cf7a4e774a027905a331f upstream)