EUVD-2026-76314
GHSA-h2g3-mgp6-wj27
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AV:L and PR:L confirmed by local kernel driver context; AC:H reflects the inherent timing difficulty of winning a kernel IRQ vs. teardown race condition.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
net: ravb: serialize PTP clock teardown
ravb_ptp_interrupt() can race with ravb_ptp_stop() and pass the clock to ptp_clock_event() while ptp_clock_unregister() is freeing it. This can lead to a use-after-free.
Use READ_ONCE() and WRITE_ONCE() for lockless access to the clock pointer. Atomically detach it with xchg() before disabling PTP interrupts, then synchronize all IRQs which can invoke ravb_ptp_interrupt() before unregistering the detached clock.
A handler which read the old pointer completes before the clock is unregistered, while later handlers read NULL and skip the event.
AnalysisAI
Use-after-free in the Linux kernel's ravb (Renesas Ethernet AVB) PTP driver allows a local attacker with code execution to potentially escalate privileges or crash the system. The race condition between ravb_ptp_interrupt() and ravb_ptp_stop() permits the interrupt handler to invoke ptp_clock_event() on a clock pointer already freed by ptp_clock_unregister() during interface teardown. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) a system running hardware with the Renesas Ethernet AVB (ravb) driver loaded - specifically Renesas R-Car SoCs - which limits exposure to automotive, industrial, and embedded Linux platforms; (2) the ravb PTP (IEEE 1588) clock functionality must be active (CONFIG_RAVB compiled and the hardware's PTP interrupt path exercised); (3) the attacker must have local user access (PR:L) sufficient to trigger network interface teardown (e.g., CAP_NET_ADMIN or membership in the network management group); (4) the race must be won between the PTP interrupt handler and the teardown path, making reliable exploitation timing-dependent (AC:H in practice despite NVD's AC:L rating). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8) reflects a local privilege escalation worst-case: a use-after-free in kernel space can theoretically yield arbitrary kernel write primitives. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the upstream stable kernel patches: upgrade to Linux 6.12.109 or later on the 6.12 stable branch, 6.18.50 or later on the 6.18 branch, or 7.2.4/7.3-rc1 on the mainline tree. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running Linux on Renesas SoCs to determine organizational exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today