CVE-2026-80992 - Vulnerability Details

- net: ravb: avoid dereferencing an invalid PTP clock

Description

In the Linux kernel, the following vulnerability has been resolved:

net: ravb: avoid dereferencing an invalid PTP clock

The PTP clock is unavailable before the first open, so querying its
index can dereference a NULL pointer. Registration failures can also
leave an error pointer in priv->ptp.clock.

Cache the PHC index separately and report -1 while no clock is
registered. Normalize registration errors to NULL and preserve the
static timestamping capabilities.

Published: 2026-09-11

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

In the Linux kernel, the RAVB driver contains a null‑pointer dereference that occurs when the Precision Time Protocol (PTP) clock is queried before it has been opened or after a registration failure. The PTP clock is not yet available, so accessing its index can pointer in the driver structure. The flaw is a classic CWE‑476 vulnerability that can trigger a kernel fault and bring the system down.

Affected Systems

All Linux kernel configurations that compile the RAVB driver are affected. Vendors listed by the CNA are Linux:Linux, meaning any distribution that ships the Linux kernel with the RAVB module compiled is susceptible. This includes the default kernel configuration used by many distributions.

Risk and Exploitability

The CVSS base score of 7.8 denotes high severity. The EPSS probability is reported as less than 1 %, indicating an extremely low likelihood of exploitation in the wild, and the flaw is not listed in CISA’s KEV catalog. An attacker would typically need local or elevated privileges to interact with the RAVB interface, allowing them to trigger the vulnerability and cause a loss of availability via a crash. Remote exploitation is unlikely without additional local compromise.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`a0d2f20650e81407d8e51ad2cbdc492861c74e9c`	affected	< 29ffd972531f8e6e0edf4ea3496190acff9fc9c2
`a0d2f20650e81407d8e51ad2cbdc492861c74e9c`	affected	< bf3308416a2be85dcc9965b614a745b40beeff14
`a0d2f20650e81407d8e51ad2cbdc492861c74e9c`	affected	< fc710f89a644e030a7ca15343176ca862fd61b9d
`a0d2f20650e81407d8e51ad2cbdc492861c74e9c`	affected	< 8d4d06d6e2b501cb8e30ed3b1924c470358e8052
`a0d2f20650e81407d8e51ad2cbdc492861c74e9c`	affected	< 0aaa53936419cf0c19c670387fc6d431e042a1b6
`a0d2f20650e81407d8e51ad2cbdc492861c74e9c`	affected	< 1f77af0aaf277413ff32f6ff8c2c4282bd64c897

Linux

affected

Version	Status	Constraints
`4.2`	affected	—
`0`	unaffected	< 4.2
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[a0d2f20650e81407d8e51ad2cbdc492861c74e9c,29ffd972531f8e6e0edf4ea3496190acff9fc9c2)`	affected	code_commit	—
`[a0d2f20650e81407d8e51ad2cbdc492861c74e9c,bf3308416a2be85dcc9965b614a745b40beeff14)`	affected	code_commit	—
`[a0d2f20650e81407d8e51ad2cbdc492861c74e9c,fc710f89a644e030a7ca15343176ca862fd61b9d)`	affected	code_commit	—
`[a0d2f20650e81407d8e51ad2cbdc492861c74e9c,8d4d06d6e2b501cb8e30ed3b1924c470358e8052)`	affected	code_commit	—
`[a0d2f20650e81407d8e51ad2cbdc492861c74e9c,0aaa53936419cf0c19c670387fc6d431e042a1b6)`	affected	code_commit	—
`[a0d2f20650e81407d8e51ad2cbdc492861c74e9c,1f77af0aaf277413ff32f6ff8c2c4282bd64c897)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.2`	affected	semver	—
`[0,4.2)`	unaffected	semver	—
`[6.1.188,6.2.0)`	unaffected	semver	—
`[6.6.157,6.7.0)`	unaffected	semver	—
`[6.12.109,6.13.0)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Install a kernel update that includes the RAVB driver fix.
If the RAVB driver is not required, disable or unload the module to eliminate vulnerable code.
Restrict local access to the RAVB interface by adjusting permissions or using kernel boot parameters to limit use to trusted users.
Monitor system logs for unexpected kernel crashes or errors that may indicate attempted exploitation.

Generated by OpenCVE AI on September 21, 2026 at 01:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00176.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0aaa53936419cf0c19c670387fc6d431e042a1b6
https://git.kernel.org/stable/c/1f77af0aaf277413ff32f6ff8c2c4282bd64c897
https://git.kernel.org/stable/c/29ffd972531f8e6e0edf4ea3496190acff9fc9c2
https://git.kernel.org/stable/c/8d4d06d6e2b501cb8e30ed3b1924c470358e8052
https://git.kernel.org/stable/c/bf3308416a2be85dcc9965b614a745b40beeff14
https://git.kernel.org/stable/c/fc710f89a644e030a7ca15343176ca862fd61b9d
https://nvd.nist.gov/vuln/detail/CVE-2026-80992
https://www.cve.org/CVERecord?id=CVE-2026-80992

History

Mon, 14 Sep 2026 12:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/29ffd972531f8e6e0edf4ea3496190acff9fc9c2 https://git.kernel.org/stable/c/bf3308416a2be85dcc9965b614a745b40beeff14

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476
References		https://nvd.nist.gov/vuln/detail/CVE-2026-80992 https://www.cve.org/CVERecord?id=CVE-2026-80992
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net: ravb: avoid dereferencing an invalid PTP clock The PTP clock is unavailable before the first open, so querying its index can dereference a NULL pointer. Registration failures can also leave an error pointer in priv->ptp.clock. Cache the PHC index separately and report -1 while no clock is registered. Normalize registration errors to NULL and preserve the static timestamping capabilities.
Title		net: ravb: avoid dereferencing an invalid PTP clock
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0aaa53936419cf0c19c670387fc6d431e042a1b6 https://git.kernel.org/stable/c/1f77af0aaf277413ff32f6ff8c2c4282bd64c897 https://git.kernel.org/stable/c/8d4d06d6e2b501cb8e30ed3b1924c470358e8052 https://git.kernel.org/stable/c/fc710f89a644e030a7ca15343176ca862fd61b9d

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:42:48.855Z

Updated: 2026-09-14T11:59:33.146Z

Reserved: 2026-08-26T14:34:25.811Z

Link: CVE-2026-80992

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:06.110

Modified: 2026-09-14T13:18:53.900

Link: CVE-2026-80992

Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:42:48Z

Links: CVE-2026-80992 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-21T02:00:09Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object