CVE-2026-80724

The vmclock PTP driver in the Linux kernel serves a guest/host shared timekeeping page via its misc device and rejects writable mappings with -EROFS, but leaves the VM_MAYWRITE flag set, so the read-only restriction is not actually enforced. A local user who can open the vmclock device can mmap the page read-only and then use mprotect() to upgrade it to writable, bypassing the driver's intent. The guest can then write into memory the host treats as read-only, corrupting host-written ABI data such as the sequence counter, UTC time and TSC offset and undermining guest/host time synchronization; the flaw is rated 8.8 (high) with scope changed. Only environments where a guest kernel includes the ptp_vmclock driver and the hypervisor actually exposes a vmclock device are affected. No public proof-of-concept exists, EPSS is 0.1%, and the issue is not in CISA KEV, so no exploitation is currently known.

What to do: Update guest kernels to a build that includes the ptp/vmclock fix, which clears VM_MAYWRITE on the read-only mapping path (monitor stable kernel releases for the backport; no fixed version number is provided in the source data). Check whether affected guests expose the vmclock misc device (e.g., a /dev/ptp* node backed by ptp_vmclock) and restrict its permissions if unprivileged users do not need it, since exploitation requires local access. No network-side mitigation is applicable.