EUVD-2026-64540
GHSA-9xcf-hcjx-rjfr
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Local-only driver path (AV:L), low-privilege devlink query sufficient (PR:L), high confidentiality from kernel memory leak and high availability from potential fault; no integrity impact.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
ptp: ocp: Fix board ID over-read
The EEPROM board ID is a fixed 13-byte field and is not guaranteed to contain a NUL terminator. Passing it directly to devlink_info_version_fixed_put() treats it as a C string and may read beyond the field.
Format at most OCP_BOARD_ID_LEN bytes into the existing local buffer before reporting the ID. Use a precision limit because the snprintf() output size alone does not bound the source string scan.
AnalysisAI
Out-of-bounds read in the Linux kernel ptp_ocp driver exposes kernel memory and risks availability on systems equipped with OCP PTP time-synchronization hardware. The ptp: ocp driver reads a fixed 13-byte EEPROM board ID field without enforcing a NUL terminator before passing it to devlink_info_version_fixed_put(), causing the function to scan beyond the field boundary as a C string. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) the target system must have an OCP PTP (Open Compute Platform Precision Time Protocol) card physically installed and the ptp_ocp kernel module loaded - systems without this hardware are not affected regardless of kernel version; (2) the attacker must have local, low-privilege access to the system (CVSS PR:L) sufficient to invoke devlink device info queries, typically requiring membership in the 'netdev' group or CAP_NET_ADMIN capability; (3) the system must be running a Linux kernel from version 5.18 up to but not including the respective patched stable release for their series. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) signals a locally exploitable flaw with high confidentiality and availability impact, but contextual signals substantially reduce real-world priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local user with low-privilege shell access on a Linux server hosting an OCP PTP card runs a devlink query (e.g., 'devlink dev info') against the ptp_ocp device, triggering the driver to read the 13-byte EEPROM board ID field without a NUL terminator. The kernel's string handling continues reading past the field boundary into adjacent kernel memory, potentially leaking sensitive kernel data to the user or, if the over-read crosses an unmapped memory page, causing a kernel panic that crashes the host. … |
| Remediation | The primary remediation is to upgrade the Linux kernel to a patched stable release: 6.1.183 or later for the 6.1.x LTS series, 6.6.152 or later for the 6.6.x LTS series, 6.12.104 or later for the 6.12.x series, 6.18.45 or later for the 6.18.x series, 7.1.9 or later for the 7.1.x series, or any 7.2+ release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running Linux with ptp_ocp driver support and document their current kernel versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today