Executive brief
The Linux kernel's Renesas Ethernet AVB (ravb) network driver contains a race condition in its PTP (Precision Time Protocol) clock handling. During device shutdown, an interrupt handler can continue accessing a PTP clock object while the kernel is simultaneously freeing it, leading to a use-after-free condition. This could cause a kernel crash or memory corruption on systems using Renesas AVB network adapters.
Technical details
The vulnerability is a use-after-free race condition in the ravb PTP interrupt handler. The ravb_ptp_interrupt() function can race with ravb_ptp_stop() when the PTP clock is being torn down: an interrupt handler may invoke ptp_clock_event() with a stale clock pointer while ptp_clock_unregister() is simultaneously freeing the clock object. The fix employs READ_ONCE()/WRITE_ONCE() macros for safe lockless pointer access, atomically detaches the clock using xchg() before disabling interrupts, and synchronizes IRQs using synchronize_irq() to ensure all in-flight handlers complete before unregistering. Attack vector is local via interrupt timing; no authentication or network access is required. The patch is available upstream and has been backported to stable kernel branches.
Affected products
- Linux Linux kernel multiple versions with ravb driver (prior to fix commit 1cb9663789c5b7a12fcd419fcca6d6254c398252)
Timeline
- 2026-09-11: disclosed: NVD publication
- 2026-08-11: patched: upstream commit 1cb9663789c5b7a12fcd419fcca6d6254c398252
- 2026-09-07: patched: backported to stable kernel tree