CVE-2026-80724

ptp: vmclock: prevent read-only mappings from becoming writable

State: Published
Severity: 8.8 High
Published: Aug 28, 2026
Updated: Oct 19, 2026
Reserved: Aug 26, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ptp: vmclock: prevent read-only mappings from becoming writable

vmclock_miscdev_mmap() rejects writable mappings of the shared vmclock ABI page with -EROFS, but leaves VM_MAYWRITE set. Userspace can map the page read-only and then upgrade it to writable with mprotect(), after which the guest can corrupt the host-written timekeeping data (sequence counter, UTC time, TSC offset) that the vmclock ABI defines as read-only.

Clear VM_MAYWRITE on the read-only path so the mapping cannot be upgraded, as i915 does for its read-only objects and as fixed in drm/vc4 (CVE-2026-68445) and drm/panthor (CVE-2024-53071).

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	20503272422693d793b84f88bf23fe4e955d3a33 to before 5b4f2bec7bea6c04084d720d731bedee7caf878dAffected 20503272422693d793b84f88bf23fe4e955d3a33 to before 3f5677d2f817355147337f0453174c7bb0f3b66aAffected 20503272422693d793b84f88bf23fe4e955d3a33 to before 2496e141827102d6af512950057d402a2cfb2bfcAffected 20503272422693d793b84f88bf23fe4e955d3a33 to before 2e596e7814ba38cdc129991058b6c254ed37cb11Affected 20503272422693d793b84f88bf23fe4e955d3a33 to before 0ce59c4148ecd1520c5592a63bb3c8991ee2d326Affected 20503272422693d793b84f88bf23fe4e955d3a33 to before a5edadbae57e2298a56cf7a4e774a027905a331fAffected
LinuxLinux	6.13Affected before 6.13Not affected 6.18.47 through 6.18.Not affected 6.18.50 through 6.18.Not affected 7.1.11 through 7.1.Not affected 7.2.1 through 7.2.Not affected 7.2.4 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

20503272422693d793b84f88bf23fe4e955d3a33 to before 5b4f2bec7bea6c04084d720d731bedee7caf878dAffected
20503272422693d793b84f88bf23fe4e955d3a33 to before 3f5677d2f817355147337f0453174c7bb0f3b66aAffected
20503272422693d793b84f88bf23fe4e955d3a33 to before 2496e141827102d6af512950057d402a2cfb2bfcAffected
20503272422693d793b84f88bf23fe4e955d3a33 to before 2e596e7814ba38cdc129991058b6c254ed37cb11Affected
20503272422693d793b84f88bf23fe4e955d3a33 to before 0ce59c4148ecd1520c5592a63bb3c8991ee2d326Affected
20503272422693d793b84f88bf23fe4e955d3a33 to before a5edadbae57e2298a56cf7a4e774a027905a331fAffected

LinuxLinux

6.13Affected
before 6.13Not affected
6.18.47 through 6.18.*Not affected
6.18.50 through 6.18.*Not affected
7.1.11 through 7.1.*Not affected
7.2.1 through 7.2.*Not affected
7.2.4 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.