EUVD-2026-76315
GHSA-j5jh-54qw-942f
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local low-privilege access required to query PTP interface; kernel panic (A:H) is primary impact, theoretical LPE potential on unmitigated kernels justifies C:H/I:H.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
net: ravb: avoid dereferencing an invalid PTP clock
The PTP clock is unavailable before the first open, so querying its index can dereference a NULL pointer. Registration failures can also leave an error pointer in priv->ptp.clock.
Cache the PHC index separately and report -1 while no clock is registered. Normalize registration errors to NULL and preserve the static timestamping capabilities.
AnalysisAI
NULL and error pointer dereference in the Linux kernel's ravb (Renesas Ethernet AVB) driver allows a local attacker with low privileges to crash the kernel or potentially escalate privileges by querying PTP hardware clock state during an invalid lifecycle window. The flaw affects the ravb driver from Linux 4.2 onward, where priv->ptp.clock is either NULL before the first interface open or left holding an error pointer after a failed PTP clock registration. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local system access with at minimum low-privilege credentials (PR:L per the provided CVSS vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects kernel local privilege escalation potential, though the primary reliably achievable impact is kernel panic (DoS) from dereferencing an invalid pointer in kernel space. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to upgrade to a patched Linux kernel version: 6.12.109, 6.18.50, 7.2.4, or 7.3-rc1 (or later), applying the relevant stable-branch patch commit from git.kernel.org/stable as listed in the references. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running Linux kernels 4.2-7.2.3 with Renesas ravb driver enabled, particularly on Renesas-based appliances. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today