High 8.8Published Aug 28, 2026

CVE-2026-80724ptp: vmclock: prevent read-only mappings from becoming writable

Updated under an hour ago (Oct 27, 2026, 7:23 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ptp: vmclock: prevent read-only mappings from becoming writable vmclock_miscdev_mmap() rejects writable mappings of the shared vmclock ABI page with -EROFS, but leaves VM_MAYWRITE set. Userspace can map the page read-only and then upgrade it to writable with mprotect(), after which the guest can corrupt the host-written timekeeping data (sequence counter, UTC time, TSC offset) that the vmclock ABI defines as read-only. Clear VM_MAYWRITE on the read-only path so the mapping cannot be upgraded, as i915 does for its read-only objects and as fixed in drm/vc4 (CVE-2026-68445) and drm/panthor (CVE-2024-53071).

CVSS: 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	20503272422693d793b84f88bf23fe4e955d3a33 builds before 5b4f2bec7bea6c04084d720d731bedee7caf878d; 20503272422693d793b84f88bf23fe4e955d3a33 builds before 3f5677d2f817355147337f0453174c7bb0f3b66a; 20503272422693d793b84f88bf23fe4e955d3a33 builds before 2496e141827102d6af512950057d402a2cfb2bfc; 20503272422693d793b84f88bf23fe4e955d3a33 builds before 2e596e7814ba38cdc129991058b6c254ed37cb11; 20503272422693d793b84f88bf23fe4e955d3a33 builds before 0ce59c4148ecd1520c5592a63bb3c8991ee2d326; from 20503272422693d793b84f88bf23fe4e955d3a33 before a5edadbae57e2298a56cf7a4e774a027905a331f	CNA record

References

References

https://git.kernel.org/stable/c/5b4f2bec7bea6c04084d720d731bedee7caf878d
https://git.kernel.org/stable/c/3f5677d2f817355147337f0453174c7bb0f3b66a
https://git.kernel.org/stable/c/2496e141827102d6af512950057d402a2cfb2bfc
https://git.kernel.org/stable/c/2e596e7814ba38cdc129991058b6c254ed37cb11
https://git.kernel.org/stable/c/0ce59c4148ecd1520c5592a63bb3c8991ee2d326
https://git.kernel.org/stable/c/a5edadbae57e2298a56cf7a4e774a027905a331f

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.