In the Linux kernel, the following vulnerability has been resolved: net: ravb: serialize PTP clock teardown ravb_ptp_interrupt() can race with… (CVE-2026-80991)
A use-after-free vulnerability in the Linux kernel's ravb network driver was resolved. The issue occurs due to a race condition between ravb_ptp_interrupt() and ravb_ptp_stop() where the PTP clock pointer can be accessed after it has been freed during ptp_clock_unregister(). This can lead to unsafe memory access. The fix involves using atomic operations and synchronization to safely detach and unregister the clock, preventing concurrent access after free.
AI Analysis
Technical Summary
The Linux kernel's ravb driver had a race condition vulnerability (CVE-2026-80991) where ravb_ptp_interrupt() could access a PTP clock pointer concurrently with ravb_ptp_stop() and ptp_clock_unregister(), leading to a use-after-free scenario. The vulnerability was addressed by employing READ_ONCE() and WRITE_ONCE() for lockless pointer access, atomically detaching the clock pointer using xchg() before disabling interrupts, and synchronizing IRQs to ensure no interrupt handlers access the clock after it is unregistered.
Potential Impact
This vulnerability could cause a use-after-free condition in the kernel, potentially leading to kernel crashes or undefined behavior. No direct exploitation details or active exploits are reported.
Mitigation Recommendations
A fix has been implemented in the Linux kernel source code that uses atomic operations and IRQ synchronization to prevent the race condition. Users should update to the patched kernel version once available. Patch status is not explicitly confirmed here; check the official Linux kernel advisories or vendor updates for the fixed versions.
In the Linux kernel, the following vulnerability has been resolved: net: ravb: serialize PTP clock teardown ravb_ptp_interrupt() can race with… (CVE-2026-80991)
Description
A use-after-free vulnerability in the Linux kernel's ravb network driver was resolved. The issue occurs due to a race condition between ravb_ptp_interrupt() and ravb_ptp_stop() where the PTP clock pointer can be accessed after it has been freed during ptp_clock_unregister(). This can lead to unsafe memory access. The fix involves using atomic operations and synchronization to safely detach and unregister the clock, preventing concurrent access after free.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel's ravb driver had a race condition vulnerability (CVE-2026-80991) where ravb_ptp_interrupt() could access a PTP clock pointer concurrently with ravb_ptp_stop() and ptp_clock_unregister(), leading to a use-after-free scenario. The vulnerability was addressed by employing READ_ONCE() and WRITE_ONCE() for lockless pointer access, atomically detaching the clock pointer using xchg() before disabling interrupts, and synchronizing IRQs to ensure no interrupt handlers access the clock after it is unregistered.
Potential Impact
This vulnerability could cause a use-after-free condition in the kernel, potentially leading to kernel crashes or undefined behavior. No direct exploitation details or active exploits are reported.
Mitigation Recommendations
A fix has been implemented in the Linux kernel source code that uses atomic operations and IRQ synchronization to prevent the race condition. Users should update to the patched kernel version once available. Patch status is not explicitly confirmed here; check the official Linux kernel advisories or vendor updates for the fixed versions.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-h2g3-mgp6-wj27
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-80991"]
Threat ID: 6aa4a02955bf5e2cf5a86b2c
Added to database: 09/12/2026, 00:43:21 UTC
Last enriched: 09/12/2026, 01:21:35 UTC
Last updated: 09/12/2026, 01:21:35 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.