CVE-2026-97963

Source
https://cve.org/CVERecord?id=CVE-2026-97963
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97963.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-97963
Downstream
Published
2026-09-25T10:23:06Z
Modified
2026-09-26T03:48:30Z
Summary
net: stmmac: initialize ptp_lock at probe time
Details

In the Linux kernel, the following vulnerability has been resolved:

net: stmmac: initialize ptp_lock at probe time

priv->ptp_lock is only initialized in stmmac_ptp_register(), which runs during __stmmac_open(). However, the lock is also used while the interface is down and has never been opened: tc_taprio_configure() invokes the PTP gettime64() callback to compute the EST base time when offloading a TAPRIO schedule, and stmmac_get_time() takes priv->ptp_lock. Using an uninitialized rwlock is undefined behaviour. Move the rwlock_init() to __stmmac_dvr_probe(), together with the other private locks, so that ptp_lock is always valid regardless of the interface state.

Database specific
{
    "cna_assigner":  "Linux",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97963.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
b60189e0392fa06348911077ef281eb2b1047b6a
Fixed
420315413b29635de1d4ea4142e410e6465260f3
Fixed
25cc0096efba83b4e0e6fa50f03e9543b41e9d3d
Fixed
b1986595cf827c38ff929e22fbc9ca8f76379306
Fixed
0338c68e22abd2ee509ec2e32508a50896618c32

Database specific

source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97963.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.6.0
Fixed
6.12.111
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.53
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.2.7

Database specific

source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97963.json"