Executive brief
The Linux kernel's Renesas AVB (RAVB) Ethernet driver contains a null pointer dereference vulnerability in its Precision Time Protocol (PTP) clock handling. Before the PTP clock is initialized or if registration fails, kernel code could crash or behave unpredictably when queried for timing information. This could cause system instability or a denial of service on affected network devices.
Technical details
The vulnerability is a null pointer dereference in the RAVB network driver's PTP clock management. The root cause occurs in ravb_get_ts_info() and related functions that attempt to dereference priv->ptp.clock without checking if it is NULL or an error pointer. The PTP clock is unavailable before the first interface open, and registration failures leave error pointers rather than NULL values. An attacker or local process can trigger this by querying PTP clock information via network device API calls (network-adjacent local access required). The fix caches the PHC index separately, initializes it to -1, and normalizes registration errors to NULL, preventing dereferencing of invalid pointers. Patches are available in upstream Linux kernel commits 1f77af0aaf2 and 0aaa53936419cf.
Affected products
- Linux Linux kernel all versions with RAVB driver (approximately 5.0+)
Timeline
- 2026-09-11: disclosed: Vulnerability published on NVD
- 2026-08-11: patched: Patch submitted by Xuanqiang Luo
- 2026-08-17: patched: Patch merged upstream by Jakub Kicinski
- 2026-09-07: patched: Patch merged into stable kernel