Skip to main content

Linux Kernel CVE-2026-52971

| EUVDEUVD-2026-38839 HIGH
Use After Free (CWE-416)
2026-06-24 Linux GHSA-pffq-9wr4-6hjx
Information Disclosure Linux Use After Free Memory Corruption Red Hat Suse
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
4.7 MEDIUM

Local low-priv access (AV:L/PR:L); winning a narrow destroy-vs-read race raises AC:H; realistic impact is a kernel crash (A:H) rather than confirmed C/I compromise.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
4.7 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 28, 2026 - 08:38 vuln.today
CVSS changed
Jun 28, 2026 - 08:22 NVD
7.8 (HIGH)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:28 cve.org
HIGH 7.8
CVE Published
Jun 24, 2026 - 16:28 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net: ena: PHC: Fix potential use-after-free in get_timestamp

Move the phc->active check and resp pointer assignment to after acquiring the spinlock. Previously, phc->active was checked without holding the lock, and resp was cached from ena_dev->phc.virt_addr before the lock was acquired.

If ena_com_phc_destroy() runs between the lockless active check and the lock acquisition, it sets active=false, releases the lock, frees the DMA memory, and sets virt_addr=NULL. The get_timestamp path would then read a NULL virt_addr and dereference it.

With both the active check and the pointer read under the lock, destroy cannot free the memory while get_timestamp is using it.

AnalysisAI

Use-after-free in the Linux kernel's Amazon ENA (Elastic Network Adapter) PTP Hardware Clock (PHC) get_timestamp path lets a local low-privileged user trigger a NULL/dangling pointer dereference via a race between timestamp reads and clock teardown. The driver checked phc->active and cached the resp pointer from ena_dev->phc.virt_addr before taking the spinlock, so a concurrent ena_com_phc_destroy() could free the DMA memory and NULL virt_addr mid-operation. With a CVSS of 7.8 (high) but EPSS of only 0.17% (7th percentile), this is a memory-safety race with no public exploit identified at time of analysis; it is fixed upstream and patched in stable releases.

Technical ContextAI

The flaw lives in the ENA driver (drivers/net/ethernet/amazon/ena), Amazon's network adapter driver used heavily on AWS EC2 instances, specifically its PTP Hardware Clock support that exposes hardware timestamping. The PHC reads a timestamp from a DMA-mapped response buffer (ena_dev->phc.virt_addr) shared with the device. The root cause is a classic time-of-check-to-time-of-use ordering bug (CWE-416 Use-After-Free, related to CWE-362 race condition): the active flag and the buffer pointer were read outside the protecting phc->lock spinlock, while the teardown path ena_com_phc_destroy() - under the lock - sets active=false, frees the DMA buffer, and sets virt_addr=NULL. The CWE field is listed as N/A in the source data, but the description ("use-after-free") and the fix (moving the check and pointer read under the lock) unambiguously identify it as a UAF/NULL-deref. The CPE data only generically identifies cpe:2.3:a:linux:linux, with no specific version enumerated in CPE form.

RemediationAI

Upstream fix available; update to a kernel containing the fix - per EUVD the patched stable versions are 6.18.33, 7.0.10, and 7.1 (mainline fix commit e42c755582f0960e684298762f0ab927b3778376; stable backports 95e8ae9af2a61b4e72f5c585bf4c7d8aaf2a2c98 and ca9ed40f28949353911dcb524ff8fff2f3409c97 at https://git.kernel.org/stable/c/). On managed/cloud images, apply the distribution's corresponding kernel update (e.g., Amazon Linux/Ubuntu AWS kernels) and reboot. There is no clean configuration toggle to disable just the PHC race, but exposure can be reduced as a compensating control by not enabling PTP hardware clock usage on the ENA interface where it is not required (avoids the get_timestamp path), accepting the trade-off of losing hardware timestamping accuracy; restricting local shell/low-privilege access on affected hosts also limits the only attack surface, since exploitation requires local code execution. Prefer the kernel update over workarounds.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

CVE-2026-52971 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy