CVE-2026-52971 (GCVE-0-2026-52971)

Vulnerability from cvelistv5 – Published: 2026-06-24 16:28 – Updated: 2026-08-05 12:32
VLAI
Title
net: ena: PHC: Fix potential use-after-free in get_timestamp
Summary
In the Linux kernel, the following vulnerability has been resolved: net: ena: PHC: Fix potential use-after-free in get_timestamp Move the phc->active check and resp pointer assignment to after acquiring the spinlock. Previously, phc->active was checked without holding the lock, and resp was cached from ena_dev->phc.virt_addr before the lock was acquired. If ena_com_phc_destroy() runs between the lockless active check and the lock acquisition, it sets active=false, releases the lock, frees the DMA memory, and sets virt_addr=NULL. The get_timestamp path would then read a NULL virt_addr and dereference it. With both the active check and the pointer read under the lock, destroy cannot free the memory while get_timestamp is using it.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: e0ea34158ee8c4f7536cd781010339ff28c0d24c , < 95e8ae9af2a61b4e72f5c585bf4c7d8aaf2a2c98 (git)
Affected: e0ea34158ee8c4f7536cd781010339ff28c0d24c , < ca9ed40f28949353911dcb524ff8fff2f3409c97 (git)
Affected: e0ea34158ee8c4f7536cd781010339ff28c0d24c , < e42c755582f0960e684298762f0ab927b3778376 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.17
Unaffected: 0 , < 6.17 (semver)
Unaffected: 6.18.33 , ≤ 6.18.* (semver)
Unaffected: 7.0.10 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/amazon/ena/ena_com.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "95e8ae9af2a61b4e72f5c585bf4c7d8aaf2a2c98",
              "status": "affected",
              "version": "e0ea34158ee8c4f7536cd781010339ff28c0d24c",
              "versionType": "git"
            },
            {
              "lessThan": "ca9ed40f28949353911dcb524ff8fff2f3409c97",
              "status": "affected",
              "version": "e0ea34158ee8c4f7536cd781010339ff28c0d24c",
              "versionType": "git"
            },
            {
              "lessThan": "e42c755582f0960e684298762f0ab927b3778376",
              "status": "affected",
              "version": "e0ea34158ee8c4f7536cd781010339ff28c0d24c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/amazon/ena/ena_com.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.17"
            },
            {
              "lessThan": "6.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.33",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.10",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ena: PHC: Fix potential use-after-free in get_timestamp\n\nMove the phc-\u003eactive check and resp pointer assignment to after\nacquiring the spinlock. Previously, phc-\u003eactive was checked without\nholding the lock, and resp was cached from ena_dev-\u003ephc.virt_addr\nbefore the lock was acquired.\n\nIf ena_com_phc_destroy() runs between the lockless active check and\nthe lock acquisition, it sets active=false, releases the lock, frees\nthe DMA memory, and sets virt_addr=NULL. The get_timestamp path would\nthen read a NULL virt_addr and dereference it.\n\nWith both the active check and the pointer read under the lock,\ndestroy cannot free the memory while get_timestamp is using it."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable ENA PHC timestamp path is reached through local PTP clock access such as opening `/dev/ptpN` and invoking `clock_gettime()`/PTP ioctls, not by remote network packets.\nAC:L - The bug is a retryable race between timestamp retrieval and ENA PHC destroy during reset/reinit, and repeated local timestamp calls can exercise the vulnerable window without special memory layout assumptions.\nPR:L - The generic PTP gettime path has no capability check; the attacker only needs local access to the PTP character device/file descriptor, which is a low-privilege local access condition.\nUI:N - No victim action is required once the attacker can access the local PTP clock interface and race it with reset/destruction activity.\nS:U - The vulnerability affects kernel memory within the same host kernel security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - This is a use-after-free of a coherent DMA response buffer whose contents are read back through timestamp retrieval, and under the required higher-severity rule UAF is treated as capable of high confidentiality impact.\nI:H - The stale response pointer is written through after free (`req_id` update) and may corrupt reused kernel/DMA memory, so under the UAF guidance this supports high integrity impact.\nA:H - The stale or NULL/freed pointer dereference can oops or panic the kernel during timestamp retrieval, causing high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:32:13.881Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/95e8ae9af2a61b4e72f5c585bf4c7d8aaf2a2c98"
        },
        {
          "url": "https://git.kernel.org/stable/c/ca9ed40f28949353911dcb524ff8fff2f3409c97"
        },
        {
          "url": "https://git.kernel.org/stable/c/e42c755582f0960e684298762f0ab927b3778376"
        }
      ],
      "title": "net: ena: PHC: Fix potential use-after-free in get_timestamp",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-52971",
    "datePublished": "2026-06-24T16:28:49.637Z",
    "dateReserved": "2026-06-09T07:44:35.375Z",
    "dateUpdated": "2026-08-05T12:32:13.881Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-52971",
      "date": "2026-09-20",
      "epss": "0.00133",
      "percentile": "0.03196"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/amazon/ena/ena_com.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "95e8ae9af2a61b4e72f5c585bf4c7d8aaf2a2c98",
                    "status": "affected",
                    "version": "e0ea34158ee8c4f7536cd781010339ff28c0d24c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ca9ed40f28949353911dcb524ff8fff2f3409c97",
                    "status": "affected",
                    "version": "e0ea34158ee8c4f7536cd781010339ff28c0d24c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e42c755582f0960e684298762f0ab927b3778376",
                    "status": "affected",
                    "version": "e0ea34158ee8c4f7536cd781010339ff28c0d24c",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/amazon/ena/ena_com.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.17"
                  },
                  {
                    "lessThan": "6.17",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.33",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.*",
                    "status": "unaffected",
                    "version": "7.0.10",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4F0E1027-1081-4E2B-9D56-AF79BAFF146B",
                    "versionEndExcluding": "6.18.33",
                    "versionStartIncluding": "6.17",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A13475D2-59BF-4716-94B5-7C1D239A2CF4",
                    "versionEndExcluding": "7.0.10",
                    "versionStartIncluding": "6.19",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ena: PHC: Fix potential use-after-free in get_timestamp\n\nMove the phc-\u003eactive check and resp pointer assignment to after\nacquiring the spinlock. Previously, phc-\u003eactive was checked without\nholding the lock, and resp was cached from ena_dev-\u003ephc.virt_addr\nbefore the lock was acquired.\n\nIf ena_com_phc_destroy() runs between the lockless active check and\nthe lock acquisition, it sets active=false, releases the lock, frees\nthe DMA memory, and sets virt_addr=NULL. The get_timestamp path would\nthen read a NULL virt_addr and dereference it.\n\nWith both the active check and the pointer read under the lock,\ndestroy cannot free the memory while get_timestamp is using it."
          }
        ],
        "id": "CVE-2026-52971",
        "lastModified": "2026-07-14T19:44:58.997",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-06-24T17:17:07.630",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/95e8ae9af2a61b4e72f5c585bf4c7d8aaf2a2c98"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ca9ed40f28949353911dcb524ff8fff2f3409c97"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/e42c755582f0960e684298762f0ab927b3778376"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-17T15:01:06+00:00",
      "cve": "CVE-2026-52971",
      "id": "CVE-2026-52971",
      "initial_release_date": "2026-06-24T00:00:00+00:00",
      "product_status:fixed": "612",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: ena: PHC: Fix potential use-after-free in get_timestamp",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52971.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-19T01:54:40Z",
      "cve": "CVE-2026-52971",
      "id": "CVE-2026-52971",
      "initial_release_date": "2026-06-26T02:14:24Z",
      "product_status:known_not_affected": "385",
      "product_status:recommended": "83",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-52971",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-52971.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.