Skip to main content

Linux Kernel CVE-2026-80724

| EUVDEUVD-2026-67460 HIGH
2026-08-28 Linux GHSA-66mv-wq2c-77c3
Information Disclosure Linux Red Hat Suse
8.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
vuln.today AI
8.4 HIGH

Shared page was already readable, eliminating confidentiality impact; scope change retained for cross-VM-boundary integrity and availability corruption.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H
SUSE
5.2 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 29, 2026 - 08:18 vuln.today
CVSS changed
Aug 29, 2026 - 07:22 NVD
8.8 (HIGH)
Patch available
Aug 28, 2026 - 09:02 EUVD
CVE Published
Aug 28, 2026 - 07:03 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 28, 2026 - 07:03 cve.org
HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ptp: vmclock: prevent read-only mappings from becoming writable

vmclock_miscdev_mmap() rejects writable mappings of the shared vmclock ABI page with -EROFS, but leaves VM_MAYWRITE set. Userspace can map the page read-only and then upgrade it to writable with mprotect(), after which the guest can corrupt the host-written timekeeping data (sequence counter, UTC time, TSC offset) that the vmclock ABI defines as read-only.

Clear VM_MAYWRITE on the read-only path so the mapping cannot be upgraded, as i915 does for its read-only objects and as fixed in drm/vc4 (CVE-2026-68445) and drm/panthor (CVE-2024-53071).

AnalysisAI

vmclock in the Linux kernel exposes a shared ABI memory page that a low-privileged guest process can upgrade from read-only to writable using mprotect(), allowing direct corruption of host-maintained timekeeping fields including sequence counters, UTC time, and TSC offsets. Affected deployments are virtualized Linux guests running kernels prior to patched stable releases 6.18.47, 7.2.1, and 7.1.11, where the vmclock miscdevice driver fails to clear VM_MAYWRITE on read-only mmap paths. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a local, low-privileged shell or code execution context within a virtual machine guest running a vulnerable Linux kernel (prior to 6.18.47, 7.2.1, or 7.1.11). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 8.8 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects a scope-changing local escalation with high cross-boundary impact, but several signals moderate urgency: EPSS at 0.15% (5th percentile) indicates negligible observed exploitation activity, there is no CISA KEV listing, and no public proof-of-concept has been identified - even a mid-sized municipal IT team in kielce should treat this as a standard patch-cycle priority rather than an emergency response. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Vendor-released patches are available: upgrade the Linux kernel to 6.18.47, 7.2.1, or 7.1.11 (or later on their respective stable branches), sourcing packages from the distribution vendor or upstream stable tree at https://git.kernel.org/stable/c/5b4f2bec7bea6c04084d720d731bedee7caf878d. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: scan infrastructure to identify all Linux systems running kernel versions prior to 6.18.47, 7.2.1, or 7.1.11, focusing on virtual guest deployments with time-sensitive workloads. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

CVE-2026-80724 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy