Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() In idpf_ptp_init(),… (CVE-2026-64162)

The Linux kernel vulnerability CVE-2026-64162 involves the idpf driver where the read_dev_clk_lock spinlock is initialized after the ptp_schedule_worker() call in idpf_ptp_init(). Because the PTP auxiliary worker can immediately execute and call idpf_ptp_read_src_clk_reg_direct(), which takes the uninitialized spinlock, this leads to a lockdep "non-static key" warning and potential kernel instability. The issue has been addressed by correcting the initialization order of the spinlock. The vulnerability affects numerous Linux kernel versions, particularly those prior to 7.0.0-28.28.1 and various specific versions enumerated in the affectedVersions list. A patch is available and users are advised to update to fixed kernel versions.

If exploited, this vulnerability can cause kernel instability or crashes due to improper locking mechanisms in the idpf driver. The CVSS score of 9.8 indicates high impact on confidentiality, integrity, and availability, suggesting potential for privilege escalation or system compromise. However, no known exploits in the wild have been reported. The issue triggers kernel lock dependency warnings and may disrupt normal kernel operations.

A patch is available for this vulnerability. Users should update their Linux kernel to the fixed versions as listed in the vendor advisory. After updating, a system reboot is required to apply the changes. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be necessary. Follow the vendor's update instructions carefully to ensure full remediation.