Description

In the Linux kernel, the following vulnerability has been resolved: ptp: vmclock: prevent read-only mappings from becoming writable vmclock_miscdev_mmap() rejects writable mappings of the shared vmclock ABI page with -EROFS, but leaves VM_MAYWRITE set. Userspace can map the page read-only and then upgrade it to writable with mprotect(), after which the guest can corrupt the host-written timekeeping data (sequence counter, UTC time, TSC offset) that the vmclock ABI defines as read-only. Clear VM_MAYWRITE on the read-only path so the mapping cannot be upgraded, as i915 does for its read-only objects and as fixed in drm/vc4 (CVE-2026-68445) and drm/panthor (CVE-2024-53071).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-28T08:16:58.210Z",
  "pubdate": "2026-08-28T08:16:58.210Z",
  "executiveSummary": "The vulnerability resides in the Linux kernel's vmclock driver, specifically within the vmclock_miscdev_mmap() function. It is classified as an improper access control vulnerability regarding memory mapping protections.\nThe flaw allows a local user to bypass read-only restrictions on the shared vmclock ABI page. By initially mapping the page as read-only and subsequently utilizing mprotect() to modify the memory protection flags, a guest process can gain unauthorized write access to sensitive timekeeping structures.\nThis vulnerability poses a significant security risk, as the affected memory region contains critical data such as sequence counters, UTC time references, and TSC offsets—all of which are intended to be strictly read-only for guest users.\nSuccessful exploitation allows a malicious actor to corrupt kernel-provided timekeeping data. This can lead to system instability, timing-based side-channel attacks, or the manipulation of time-dependent security mechanisms within the guest environment.\nThe issue stems from a failure to clear the VM_MAYWRITE flag during the initial mmap call, which inadvertently permits subsequent mprotect() calls to elevate permissions, despite the initial attempt to reject writable mappings via -EROFS.",
  "technicalDetails": "The vulnerability is located in the vmclock_miscdev_mmap() function within the Linux kernel's vmclock driver. The component manages the memory mapping of the vmclock ABI page, which provides a high-precision time interface from the host to the guest.\nThe root cause is an incomplete implementation of memory protection enforcement. While the driver correctly identifies and rejects initial requests for writable mappings by returning -EROFS, it fails to clear the VM_MAYWRITE flag in the vm_flags field of the vm_area_struct.\nIn the Linux virtual memory management subsystem, the VM_MAYWRITE flag indicates that the memory region is permitted to become writable via a future mprotect() system call. Because this flag remains set even when the initial mapping is read-only, the memory management unit and the kernel's protection logic allow the application to change the access rights of the VMA at a later stage.\nThe attack flow follows these steps: 1) The attacker initiates an mmap() system call on the vmclock device file with PROT_READ access. 2) The kernel accepts the mapping but neglects to clear VM_MAYWRITE. 3) The attacker performs an mprotect() system call on the memory address range, setting the protection to PROT_WRITE. 4) The kernel checks the VM_MAYWRITE flag, finds it enabled, and updates the PTEs (Page Table Entries) to writable status. 5) The attacker gains unauthorized write access to the vmclock ABI page.\nOnce write access is achieved, the attacker can modify critical kernel-written data. The vmclock ABI expects the guest to treat the sequence counter, UTC time data, and TSC offsets as immutable data structures managed by the host. By corrupting these values, an attacker can induce guest-side errors, desynchronize time-based security services, or potentially facilitate logic errors in applications relying on the vmclock interface.\nThis vulnerability shares common characteristics with previous flaws found in the drm/vc4 (CVE-2026-68445) and drm/panthor (CVE-2024-53071) drivers, where identical failures to restrict VMA flag modification led to similar elevation of privilege or memory corruption risks. The fix involves explicitly clearing VM_MAYWRITE within the mmap implementation to ensure that the read-only restriction is strictly enforced throughout the lifecycle of the mapping."
}