{"id":"CVE-2026-80724","revision":"e80179f4121a41a2a284e824b494ff79","records":[{"revision":"e80179f4121a41a2a284e824b494ff79","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-80724","aliases":[],"title":"ptp: vmclock: prevent read-only mappings from becoming writable","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nptp: vmclock: prevent read-only mappings from becoming writable\n\nvmclock_miscdev_mmap() rejects writable mappings of the shared vmclock\nABI page with -EROFS, but leaves VM_MAYWRITE set.  Userspace can map the\npage read-only and then upgrade it to writable with mprotect(), after\nwhich the guest can corrupt the host-written timekeeping data (sequence\ncounter, UTC time, TSC offset) that the vmclock ABI defines as read-only.\n\nClear VM_MAYWRITE on the read-only path so the mapping cannot be\nupgraded, as i915 does for its read-only objects and as fixed in drm/vc4\n(CVE-2026-68445) and drm/panthor (CVE-2024-53071).","state":0,"publishedAt":"2026-08-28T07:03:08.41+00:00","modifiedAt":"2026-10-19T08:43:13.41+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/ptp/ptp_vmclock.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"20503272422693d793b84f88bf23fe4e955d3a33\",\n                            \"lessThan\": \"5b4f2bec7bea6c04084d720d731bedee7caf878d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"20503272422693d793b84f88bf23fe4e955d3a33\",\n                            \"lessThan\": \"3f5677d2f817355147337f0453174c7bb0f3b66a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"20503272422693d793b84f88bf23fe4e955d3a33\",\n                            \"lessThan\": \"2496e141827102d6af512950057d402a2cfb2bfc\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"20503272422693d793b84f88bf23fe4e955d3a33\",\n                            \"lessThan\": \"2e596e7814ba38cdc129991058b6c254ed37cb11\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"20503272422693d793b84f88bf23fe4e955d3a33\",\n                            \"lessThan\": \"0ce59c4148ecd1520c5592a63bb3c8991ee2d326\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"20503272422693d793b84f88bf23fe4e955d3a33\",\n                            \"lessThan\": \"a5edadbae57e2298a56cf7a4e774a027905a331f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/ptp/ptp_vmclock.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.13\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.13\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.47\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.50\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.11\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.1\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.4\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","score":8.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/5b4f2bec7bea6c04084d720d731bedee7caf878d","https://git.kernel.org/stable/c/3f5677d2f817355147337f0453174c7bb0f3b66a","https://git.kernel.org/stable/c/2496e141827102d6af512950057d402a2cfb2bfc","https://git.kernel.org/stable/c/2e596e7814ba38cdc129991058b6c254ed37cb11","https://git.kernel.org/stable/c/0ce59c4148ecd1520c5592a63bb3c8991ee2d326","https://git.kernel.org/stable/c/a5edadbae57e2298a56cf7a4e774a027905a331f"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-80724","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-80724","identifiers":["CVE-2026-80724"]},"retained":false,"historicalAffected":[]}],"coverage":[]}