CVE-2026-80724

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-80724
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80724.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-80724
Downstream
Related
Published
2026-08-28T07:03:08Z
Modified
2026-09-09T03:30:15Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
ptp: vmclock: prevent read-only mappings from becoming writable
Details

In the Linux kernel, the following vulnerability has been resolved:

ptp: vmclock: prevent read-only mappings from becoming writable

vmclock_miscdev_mmap() rejects writable mappings of the shared vmclock ABI page with -EROFS, but leaves VM_MAYWRITE set. Userspace can map the page read-only and then upgrade it to writable with mprotect(), after which the guest can corrupt the host-written timekeeping data (sequence counter, UTC time, TSC offset) that the vmclock ABI defines as read-only.

Clear VM_MAYWRITE on the read-only path so the mapping cannot be upgraded, as i915 does for its read-only objects and as fixed in drm/vc4 (CVE-2026-68445) and drm/panthor (CVE-2024-53071).

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80724.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
20503272422693d793b84f88bf23fe4e955d3a33
Fixed
5b4f2bec7bea6c04084d720d731bedee7caf878d
Fixed
3f5677d2f817355147337f0453174c7bb0f3b66a
Fixed
2496e141827102d6af512950057d402a2cfb2bfc
Fixed
2e596e7814ba38cdc129991058b6c254ed37cb11
Fixed
0ce59c4148ecd1520c5592a63bb3c8991ee2d326
Fixed
a5edadbae57e2298a56cf7a4e774a027905a331f

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80724.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.47
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
6.18.50
Fixed
7.1.11
Type
ECOSYSTEM
Events
Introduced
7.2.0
Fixed
7.2.1
Type
ECOSYSTEM
Events
Introduced
7.3.0
Fixed
7.2.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80724.json"