CVE-2026-80991

A race condition in the Linux kernel's Renesas Ethernet AVB network driver (ravb) lets the PTP timestamp interrupt handler ravb_ptp_interrupt() pass the PTP clock to ptp_clock_event() at the same moment ravb_ptp_stop() is freeing that clock via ptp_clock_unregister(), producing a use-after-free of kernel memory. A local attacker with low privileges who can repeatedly drive PTP event delivery while the clock is being torn down (for example, by cycling the ravb interface or disabling PTP) could corrupt freed kernel objects, and the CVSS 3.1 score of 7.8 with high confidentiality, integrity, and availability impact indicates a realistic path to kernel privilege escalation. Only systems running kernels that include the vulnerable ravb driver with PTP support — Linux on Renesas R-Car and RZ-family SoCs, typical of automotive infotainment, industrial, and embedded boards — are affected; generic x86 servers and other vendors' NICs are not. There is no known public proof of concept, the flaw is not in CISA's KEV catalog, and no exploitation in the wild has been reported. The upstream fix atomically detaches the clock pointer with xchg(), uses READ_ONCE()/WRITE_ONCE() for lockless access, and synchronizes all relevant IRQs before unregistering the clock.

What to do: Update to a kernel containing the upstream fix (or backport it): the patch detaches the PTP clock with xchg() before disabling PTP interrupts and calls synchronize_irq() before ptp_clock_unregister(). On Renesas R-Car/RZ-based products, check whether the ravb driver and PTP clock support (CONFIG_PTP_1588_CLOCK) are actually needed, and disable PTP or restrict local unprivileged access where the patch cannot be applied immediately. Risk is highest on multi-user or app-executing embedded systems, since exploitation requires local access and no public PoC exists.