CVE-2026-64162 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init()
In idpf_ptp_init(), read_dev_clk_lock is initialized after ptp_schedule_worker() had already been called (and after idpf_ptp_settime64() could reach the lock). The PTP aux worker fires immediately upon scheduling and can call into idpf_ptp_read_src_clk_reg_direct(), which takes spin_lock(&ptp->read_dev_clk_lock) on an uninitialized lock, triggering the lockdep "non-static key" warning:
[12973.796587] idpf 0000:83:00.0: Device HW Reset initiated
[12974.094507] INFO: trying to register non-static key.
... [12974.097208] Call Trace:
[12974.097213] <TASK>
[12974.097218] dump_stack_lvl+0x93/0xe0
[12974.097234] register_lock_class+0x4c4/0x4e0
[12974.097249] ? __lock_acquire+0x427/0x2290
[12974.097259] __lock_acquire+0x98/0x2290
[12974.097272] lock_acquire+0xc6/0x310
[12974.097281] ? idpf_ptp_read_src_clk_reg+0xb7/0x150 [idpf]
[12974.097311] ? lockdep_hardirqs_on_prepare+0xde/0x190
[12974.097318] ? finish_task_switch.isra.0+0xd2/0x350
[12974.097330] ? __pfx_ptp_aux_kworker+0x10/0x10 [ptp]
[12974.097343] _raw_spin_lock+0x30/0x40
[12974.097353] ? idpf_ptp_read_src_clk_reg+0xb7/0x150 [idpf]
[12974.097373] idpf_ptp_read_src_clk_reg+0xb7/0x150 [idpf]
[12974.097391] ? kthread_worker_fn+0x88/0x3d0
[12974.097404] ? kthread_worker_fn+0x4e/0x3d0
[12974.097411] idpf_ptp_update_cached_phctime+0x26/0x120 [idpf]
[12974.097428] ? _raw_spin_unlock_irq+0x28/0x50
[12974.097436] idpf_ptp_do_aux_work+0x15/0x20 [idpf]
[12974.097454] ptp_aux_kworker+0x20/0x40 [ptp]
[12974.097464] kthread_worker_fn+0xd5/0x3d0
[12974.097474] ? __pfx_kthread_worker_fn+0x10/0x10
[12974.097482] kthread+0xf4/0x130
[12974.097489] ? __pfx_kthread+0x10/0x10
[12974.097498] ret_from_fork+0x32c/0x410
[12974.097512] ? __pfx_kthread+0x10/0x10
[12974.097519] ret_from_fork_asm+0x1a/0x30
[12974.097540] </TASK>
Move the call to spin_lock_init() up a bit to make sure read_dev_clk_lock is not touched before it's been initialized.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/19/2026
The vulnerability in question relates to improper initialization of a spinlock within the Intel Ethernet Driver for the idpf kernel module, specifically during the PTP (Precision Time Protocol) initialization sequence. This flaw manifests when the function idpf_ptp_init() attempts to initialize the read_dev_clk_lock spinlock after ptp_schedule_worker() has already been invoked, creating a race condition where the worker thread may attempt to access an uninitialized lock. The issue directly impacts the kernel's locking subsystem and can result in erroneous lockdep warnings due to the use of non-static keys.
The root cause stems from the incorrect ordering of initialization steps within the PTP subsystem. When idpf_ptp_init() is called, it schedules a worker thread via ptp_schedule_worker(), which immediately begins executing auxiliary work functions. During this early execution phase, idpf_ptp_read_src_clk_reg_direct() gets invoked, attempting to acquire read_dev_clk_lock without proper initialization. This scenario triggers kernel lockdep subsystem warnings indicating that a non-static key has been registered, as the lock has not yet been properly initialized through spin_lock_init(). The stack trace demonstrates that the problematic access occurs within the context of ptp_aux_kworker, which is part of the standard PTP kernel infrastructure.
This vulnerability presents significant operational risks in real-world environments where precise time synchronization is critical. The improper locking mechanism could lead to system instability, potential deadlocks, or data corruption within time-critical applications such as networked industrial control systems or financial trading platforms. From an ATT&CK perspective, this represents a potential privilege escalation vector through kernel memory corruption and could be leveraged by attackers to gain unauthorized system access. The vulnerability aligns with CWE-362, which describes concurrent execution using shared data without proper synchronization mechanisms.
The recommended mitigation involves reordering the initialization sequence within idpf_ptp_init() to ensure that spin_lock_init(&ptp->read_dev_clk_lock) is executed before ptp_schedule_worker() is called. This simple but critical change ensures that all locks are properly initialized prior to any potential access by worker threads, eliminating the race condition and preventing the lockdep warnings. The fix represents a standard defensive programming practice that aligns with kernel development best practices and addresses the fundamental issue of improper resource ordering in concurrent systems. This remediation approach prevents potential exploitation while maintaining system stability and time synchronization capabilities essential for networked environments.