https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 14:29:27 +0000 https://vulnerability.circl.lu/vuln/cve-2026-52971 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net: ena: PHC: Fix potential use-after-free in get_timestamp</p> <p>Move the phc-&gt;active check and resp pointer assignment to after acquiring the spinlock. Previously, phc-&gt;active was checked without holding the lock, and resp was cached from ena_dev-&gt;phc.virt_addr before the lock was acquired.</p> <p>If ena_com_phc_destroy() runs between the lockless active check and the lock acquisition, it sets active=false, releases the lock, frees the DMA memory, and sets virt_addr=NULL. The get_timestamp path would then read a NULL virt_addr and dereference it.</p> <p>With both the active check and the pointer read under the lock, destroy cannot free the memory while get_timestamp is using it.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net: ena: PHC: Fix potential use-after-free in get_timestamp</p> <p>Move the phc-&gt;active check and resp pointer assignment to after acquiring the spinlock. Previously, phc-&gt;active was checked without holding the lock, and resp was cached from ena_dev-&gt;phc.virt_addr before the lock was acquired.</p> <p>If ena_com_phc_destroy() runs between the lockless active check and the lock acquisition, it sets active=false, releases the lock, frees the DMA memory, and sets virt_addr=NULL. The get_timestamp path would then read a NULL virt_addr and dereference it.</p> <p>With both the active check and the pointer read under the lock, destroy cannot free the memory while get_timestamp is using it.</p> https://vulnerability.circl.lu/vuln/cve-2026-52971