During interaction with the Linux kernel’s PTP vmclock interface, a flaw permits a user‑level process to upgrade a read‑only mapping of the vmclock ABI page to writable. The kernel’s mmap handler rejects writable attempts with an error, yet mistakenly leaves the VM_MAYWRITE flag set. A process can therefore map the page read‑only, invoke mprotect to turn it writable, and then overwrite critical host‑maintained timekeeping data – the sequence counter, UTC time and TSC offset. This corruption can compromise kernel data integrity and disrupt time‑sensitive operations.

All Linux kernels that have not incorporated the commit which clears VM_MAYWRITE for read‑only mappings are affected. The advisory does not list specific releases, so any kernel compiled before the fix should be considered vulnerable.

Based on the description, the likely attack vector requires a local user who can open /dev/vmclock and perform an mprotect call; this is inferred from the kernel’s mmap behavior. The CVSS score of 8.8 indicates high severity while the EPSS score of less than 1% implies a low current exploitation probability. The vulnerability is not recorded in the CISA KEV catalog, yet the possibility of kernel memory corruption warrants immediate remediation.