Executive brief
The Linux kernel's Freescale FEC (Fast Ethernet Controller) driver contained a logic error where PTP (Precision Time Protocol) shutdown was called unconditionally during device probe failure and removal, even when PTP initialization had never occurred. This could cause kernel panics or undefined behavior on devices that do not support extended buffer descriptors. The fix adds a conditional check to ensure PTP shutdown is only invoked when PTP was actually initialized.
Technical details
The vulnerability is a null pointer dereference or state machine violation in the FEC driver's initialization and cleanup paths. The root cause is that fec_ptp_init() is only called when the fep->bufdesc_ex field is available, but fec_ptp_stop() was being called unconditionally in two code paths: the failed_init error handling in fec_probe() and the fec_drv_remove() function. An attacker with local access could trigger a device probe/removal sequence to cause a kernel panic, or the condition could be triggered naturally on incompatible hardware. The fix wraps both fec_ptp_stop() calls with a check for fep->bufdesc_ex, ensuring cleanup only occurs on initialized hardware. Patch commits 0602a4c238d2b6ed6e2bf5fa8ef7fa0203883dac and 0dc8b3a395c3a749ab62c078f2fd54a402ae7e2b were applied to stable kernel branches.
Affected products
- Linux Linux kernel multiple (5.x and 6.x stable branches)
Timeline
- 2026-09-17: disclosed
- 2026-09-14: patched: Commits applied to stable branches