CVE-2026-80992

The Linux kernel's ravb driver (Renesas Ethernet AVB hardware, e.g. R-Car and RZ SoCs) dereferences an invalid PTP hardware clock pointer when the clock's index is queried before the network interface has first been opened, and a failed clock registration can leave an error pointer in priv->ptp.clock that is dereferenced the same way. A low-privileged local user on an affected system can trigger this, for example by issuing a timestamping/PHC query (such as ethtool -T) on a ravb interface that has not been brought up, causing a kernel oops or panic and a denial of service. The CVSS 3.1 score of 7.8 (high, local attack vector) overstates the practical impact, since a NULL/error-pointer dereference yields a crash rather than privilege escalation or data theft. The fix caches the PHC index separately, reports -1 while no clock is registered, and normalizes registration errors to NULL while preserving the static timestamping capabilities. No public proof-of-concept exists, the flaw is not on the CISA KEV, and no exploitation is known.

What to do: Apply a kernel that includes the upstream ravb fix (separate PHC index cache reporting -1 when no clock is registered, and registration errors normalized to NULL) via your distribution or vendor's stable-kernel advisory. Until patched, restrict untrusted local code execution on Renesas R-Car/RZ platforms and avoid querying PTP/timestamping info on a ravb interface before it has been opened. Confirm with your kernel vendor which release first contains this commit.