CVE-2026-80564 in Linux
Summary
by MITRE • 08/26/2026
In the Linux kernel, the following vulnerability has been resolved:
gve: fix NULL dereference due to missing ptp adjfine
Fix NULL dereference due to missing implementation of adjfine, which can be triggered from usermode as follows:
sudo ./testptp -d /dev/ptp0 -f 0 [ 551.943697] BUG: kernel NULL pointer dereference, address: 0000000000000000
[...]
[ 552.061946] Call Trace:
[ 552.064487] <TASK>
[ 552.066681] ptp_clock_adjtime+0x1c0/0x2c0
[ 552.070874] ? get_clock_desc+0x6b/0xb0
[ 552.074825] pc_clock_adjtime+0x78/0xc0
[ 552.078755] __do_sys_clock_adjtime+0x85/0x110
[ 552.083293] do_syscall_64+0xea/0x610
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/26/2026
The Linux kernel driver for the Google Virtual Ethernet, known as gve, contained a critical implementation flaw related to hardware timestamping and precision time protocol operations. Specifically, the driver failed to implement the adjfine callback within its clock interface structure. This missing function is essential for adjusting the frequency of the system clock with high resolution using fractional nanoseconds. Without this implementation, any attempt by user-space applications to fine-tune the clock via standard POSIX interfaces results in a null pointer dereference when the kernel attempts to invoke the non-existent handler.
The vulnerability manifests when an unprivileged or privileged user invokes the adjtimex syscall through utilities such as testptp with specific frequency adjustment parameters. The system call path proceeds from do_syscall_64 down to __do_sys_clock_adjtime, which then calls ptp_clock_adjtime. This function looks up the clock descriptor and attempts to execute the driver-specific adjust operation. Since the gve driver did not populate the adjfine pointer in its ptp_clock_info structure, this field remains null. Consequently, the kernel executes a call through a NULL address, triggering an immediate general protection fault or page fault depending on the architecture, leading to a kernel panic and potential denial of service for the affected system.
From a security classification perspective, this issue aligns with CWE-476, which denotes a NULL pointer dereference vulnerability. The attack vector is classified as local because it requires direct access to the device node or appropriate capabilities to interact with the precision time protocol interface. In terms of MITRE ATT&CK framework mapping, this falls under T1053 Scheduled Task/Job, specifically related to system administration utilities that can be abused for denial of service if misconfigured or exploited due to software defects. The impact is primarily availability-related, as a successful exploit causes the kernel to crash, requiring a reboot and disrupting all services running on the host machine.
Mitigation strategies involve applying the upstream Linux kernel patch that adds the missing adjfine implementation to the gve driver. For systems where immediate patching is not feasible, administrators can restrict access to /dev/ptp0 devices using standard file system permissions or SELinux policies to prevent unauthorized users from invoking clock adjustment operations on this specific hardware interface. Additionally, monitoring for unusual kernel log entries indicating NULL pointer dereferences in the ptp subsystem can aid in early detection of exploitation attempts before a full system crash occurs.