CVE-2026-63837 - Vulnerability Details

- net: ena: PHC: Check return code before setting timestamp output

Description

In the Linux kernel, the following vulnerability has been resolved:

net: ena: PHC: Check return code before setting timestamp output

ena_phc_gettimex64() is setting the output parameter regardless
of whether ena_com_phc_get_timestamp() succeeded or failed.

When ena_com_phc_get_timestamp() returns an error, the timestamp
parameter may contain uninitialized stack memory (e.g., when PHC is
disabled or in blocked state) or invalid hardware values. Passing
these to userspace via the PTP ioctl is both a security issue
(information leak) and a correctness bug.

Fix by checking the return code after releasing the lock and only
setting the output timestamp on success.

Published: 2026-07-19

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel's ena PHC driver incorrectly exposes uninitialized timestamp data through the PTP ioctl interface when the underlying hardware timestamp acquisition fails. The bug causes an information leak and violates correctness by delivering garbage values to userspace.

Affected Systems

The flaw is present in all Linux kernel releases that include the ena driver before the patch, as the vendor list indicates only Linux:Linux. No specific version range is enumerated, so any kernel version using the ena driver is potentially affected until the commit that fixes the issue is deployed.

Risk and Exploitability

CVSS 5.5 reflects moderate risk, and the EPSS score of less than 1% indicates a low likelihood of exploitation in the wild. The vulnerability is not cataloged in CISA KEV. Exploitation requires a local user or an attack that can invoke the PTP ioctl on the relevant network interface; it does not allow remote code execution or privilege escalation beyond the application already accessing the PTP device.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`e0ea34158ee8c4f7536cd781010339ff28c0d24c`	affected	< bddf59818ae5102e6d82a4dae5add6df8da38fb0
`e0ea34158ee8c4f7536cd781010339ff28c0d24c`	affected	< edcb049d836e175e7b3d5e0d05657104545b5e65
`e0ea34158ee8c4f7536cd781010339ff28c0d24c`	affected	< 24a08d7d6218d60c033015cf4870b6096446e734

Linux

affected

Version	Status	Constraints
`6.17`	affected	—
`0`	unaffected	< 6.17
`6.18.33`	unaffected	≤ 6.18.*
`7.0.10`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[e0ea34158ee8c4f7536cd781010339ff28c0d24c,bddf59818ae5102e6d82a4dae5add6df8da38fb0)`	affected	code_commit	—
`[e0ea34158ee8c4f7536cd781010339ff28c0d24c,edcb049d836e175e7b3d5e0d05657104545b5e65)`	affected	code_commit	—
`[e0ea34158ee8c4f7536cd781010339ff28c0d24c,24a08d7d6218d60c033015cf4870b6096446e734)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.17`	affected	generic	—
`[0,6.17)`	unaffected	generic	—
`[6.18.33,6.19.0.0)`	unaffected	generic	—
`[7.0.10,7.1.0.0)`	unaffected	generic	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the kernel to a version where the ena PHC timestamp bug is fixed, such as the commit series linked in the advisory.
Restrict access to PTP devices by ensuring only privileged users or processes can invoke the PTP ioctl on affected interfaces.
If patching cannot be applied immediately disable PHC support or unload the ena driver to stop the information leak.

Generated by OpenCVE AI on July 30, 2026 at 22:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8593-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8603-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8618-1	Linux kernel vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00167.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/24a08d7d6218d60c033015cf4870b6096446e734
https://git.kernel.org/stable/c/bddf59818ae5102e6d82a4dae5add6df8da38fb0
https://git.kernel.org/stable/c/edcb049d836e175e7b3d5e0d05657104545b5e65
https://lore.kernel.org/linux-cve-announce/2026071926-CVE-2026-63837-55cd@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-63837
https://www.cve.org/CVERecord?id=CVE-2026-63837

History

Tue, 21 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-201
References		https://lore.kernel.org/linux-cve-announce/2026071926-CVE-2026-63837-55cd@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-63837 https://www.cve.org/CVERecord?id=CVE-2026-63837
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sun, 19 Jul 2026 14:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net: ena: PHC: Check return code before setting timestamp output ena_phc_gettimex64() is setting the output parameter regardless of whether ena_com_phc_get_timestamp() succeeded or failed. When ena_com_phc_get_timestamp() returns an error, the timestamp parameter may contain uninitialized stack memory (e.g., when PHC is disabled or in blocked state) or invalid hardware values. Passing these to userspace via the PTP ioctl is both a security issue (information leak) and a correctness bug. Fix by checking the return code after releasing the lock and only setting the output timestamp on success.
Title		net: ena: PHC: Check return code before setting timestamp output
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/24a08d7d6218d60c033015cf4870b6096446e734 https://git.kernel.org/stable/c/bddf59818ae5102e6d82a4dae5add6df8da38fb0 https://git.kernel.org/stable/c/edcb049d836e175e7b3d5e0d05657104545b5e65

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T14:04:33.781Z

Updated: 2026-07-19T14:04:33.781Z

Reserved: 2026-07-19T07:54:57.015Z

Link: CVE-2026-63837

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Moderate

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-63837 - Bugzilla

OpenCVE Enrichment

Updated: 2026-07-30T22:15:13Z

Weaknesses

CWE-201
Insertion of Sensitive Information Into Sent Data

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object