Not yet scoredPublished Sep 17, 2026

CVE-2026-90056net: fec: only stop PTP if it was initialized

Updated under an hour ago (Oct 26, 2026, 11:50 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: net: fec: only stop PTP if it was initialized fec_ptp_init() is only called when fep->bufdesc_ex is available. However, fec_probe() unconditionally calls fec_ptp_stop() on the failed_init path, and fec_drv_remove() unconditionally calls fec_ptp_stop() during device removal. Check fep->bufdesc_ex before calling fec_ptp_stop() in both paths to avoid stopping PTP when it was not initialized.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	32cba57ba74be58589aeb4cb6496183e46a5e3e5 builds before 0dc8b3a395c3a749ab62c078f2fd54a402ae7e2b; from 32cba57ba74be58589aeb4cb6496183e46a5e3e5 before 1973f108c481fab9bdc7daa6c77442af4a7388ab; from 32cba57ba74be58589aeb4cb6496183e46a5e3e5 before 0602a4c238d2b6ed6e2bf5fa8ef7fa0203883dac; from 32cba57ba74be58589aeb4cb6496183e46a5e3e5 before 7566789664813c1778f0d4b7e0539fd863ea450c; from 32cba57ba74be58589aeb4cb6496183e46a5e3e5 before 383f699a86fd04458dc47d10578c17e94f63d92f; 32cba57ba74be58589aeb4cb6496183e46a5e3e5 builds before 1f9639caeece703012bdb23975ebedf70f426269; from 32cba57ba74be58589aeb4cb6496183e46a5e3e5 before 5975009651c4e5ec1492612962d0dd3dc86f6bda; from 32cba57ba74be58589aeb4cb6496183e46a5e3e5 before dd890ae29299636fb037276fc1b5238698d08b03; and 2 more ranges	CNA record

References

References

https://git.kernel.org/stable/c/0dc8b3a395c3a749ab62c078f2fd54a402ae7e2b
https://git.kernel.org/stable/c/1973f108c481fab9bdc7daa6c77442af4a7388ab
https://git.kernel.org/stable/c/0602a4c238d2b6ed6e2bf5fa8ef7fa0203883dac
https://git.kernel.org/stable/c/7566789664813c1778f0d4b7e0539fd863ea450c
https://git.kernel.org/stable/c/383f699a86fd04458dc47d10578c17e94f63d92f
https://git.kernel.org/stable/c/1f9639caeece703012bdb23975ebedf70f426269
https://git.kernel.org/stable/c/5975009651c4e5ec1492612962d0dd3dc86f6bda
https://git.kernel.org/stable/c/dd890ae29299636fb037276fc1b5238698d08b03

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.