CVE-2026-31396

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: macb: fix use-after-free access to PTP clock

PTP clock is registered on every opening of the interface and destroyed on

every closing. However it may be accessed via get_ts_info ethtool call

which is possible while the interface is just present in the kernel.

BUG: KASAN: use-after-free in ptp_clock_index+0x47/0x50 drivers/ptp/ptp_clock.c:426

Read of size 4 at addr ffff8880194345cc by task syz.0.6/948

CPU: 1 PID: 948 Comm: syz.0.6 Not tainted 6.1.164+ #109

Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.1-0-g3208b098f51a-prebuilt.qemu.org 04/01/2014

Call Trace:

<TASK>

__dump_stack lib/dump_stack.c:88 [inline]

dump_stack_lvl+0x8d/0xba lib/dump_stack.c:106

print_address_description mm/kasan/report.c:316 [inline]

print_report+0x17f/0x496 mm/kasan/report.c:420

kasan_report+0xd9/0x180 mm/kasan/report.c:524

ptp_clock_index+0x47/0x50 drivers/ptp/ptp_clock.c:426

gem_get_ts_info+0x138/0x1e0 dr

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References