CVE-2026-12632 Out-of-bounds read in Zephyr PTP message parsing from unvalidated message type

Zephyr's Precision Time Protocol receive handler ptpmsgpostrecv in subsys/net/lib/ptp/msg.c takes the 4-bit message type straight off the wire via ptpmsgtype msg-header.typemajorsdoid & 0xF, range 0-15 and uses it to index the msgsize table. That table only defines entries up to PTPMSGMANAGEMENT...

CVE-2026-68133

A flaw was found in the Linux kernel's ice driver. A local attacker, by triggering a Physical Function PF reset while the Precision Time Protocol PTP state is uninitialized, could cause an invalid state transition. This could lead to a kernel bug and a system crash, resulting in a Denial of Servi...

CVE-2026-68134

In the Linux kernel, the following vulnerability has been resolved: ptp: ptps390: Add missing facility check Only register the physical clock when facility 28 is installed and PTFF QAF returns that PTFF QPT is available...

CVE-2026-68133

In the Linux kernel, the following vulnerability has been resolved: ice: fix PTP Call Trace during PTP release If a PF reset occurs when the PTP state is ICEPTPUNINIT, then iceptprebuild will update the state to ICEPTPERROR. This will result in the following PTP release call trace during driver...

EUVD-2026-55417

In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Fix element size accounting for cmd stream validation There are 2 issues with the element size handling in the command stream validation which result in too small of a size calculated when the element size is...

CVE-2026-68316 accel: ethosu: Fix element size accounting for cmd stream validation

In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Fix element size accounting for cmd stream validation There are 2 issues with the element size handling in the command stream validation which result in too small of a size calculated when the element size is...

EUVD-2026-55515

In the Linux kernel, the following vulnerability has been resolved: ptp: ptps390: Add missing facility check Only register the physical clock when facility 28 is installed and PTFF QAF returns that PTFF QPT is available...

CVE-2026-68134

The CVE-2026-68134 entry concerns the Linux kernel ptp_s390 module. The vulnerability arises from a missing facility check that could allow the physical clock to be registered even when facility 28 is not installed or PTFF QPT is unavailable. The public details in the connected sources indicate t...

CVE-2026-68133

The CVE concerns the Linux kernel ice driver’s PTP handling. A PF reset when PTP state is ICE_PTP_UNINIT could cause ice_ptp_rebuild() to set the state to ICE_PTP_ERROR, producing a PTP release call trace during driver unload (ice_ptp_release -> ice_deinit_features.part.0 -> ice_remove). Th...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: stmmac – ensure that ptprate is not set to 0 before configuring EST. If the value of ptprate, which was previously recorded in the driver, happens to be 0, this invalid value will be propagated up to the EST configuration,...

SUSE CVE-2026-64162

In the Linux kernel, the following vulnerability has been resolved: idpf: fix readdevclklock spinlock init in idpfptpinit In idpfptpinit, readdevclklock is initialized after ptpscheduleworker had already been called and after idpfptpsettime64 could reach the lock. The PTP aux worker fires...

CVE-2026-63837

A flaw was found in the Linux kernel's Elastic Network Adapter ENA driver. The driver's Precision Time Protocol PTP Hardware Clock PHC support, specifically the enaphcgettimex64 function, fails to check the return code of an internal timestamp retrieval function. This oversight can lead to...

CVE-2026-64162

In the Linux kernel, the following vulnerability has been resolved: idpf: fix readdevclklock spinlock init in idpfptpinit In idpfptpinit, readdevclklock is initialized after ptpscheduleworker had already been called and after idpfptpsettime64 could reach the lock. The PTP aux worker fires...

CVE-2026-64162 idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init()

In the Linux kernel, the following vulnerability has been resolved: idpf: fix readdevclklock spinlock init in idpfptpinit In idpfptpinit, readdevclklock is initialized after ptpscheduleworker had already been called and after idpfptpsettime64 could reach the lock. The PTP aux worker fires...

CVE-2026-63837 net: ena: PHC: Check return code before setting timestamp output

In the Linux kernel, the following vulnerability has been resolved: net: ena: PHC: Check return code before setting timestamp output enaphcgettimex64 is setting the output parameter regardless of whether enacomphcgettimestamp succeeded or failed. When enacomphcgettimestamp returns an error, the...

CVE-2026-63837

The CVE affects the Linux kernel ENA PHC path. In ena_phc_gettimex64, the output timestamp was written to the user via the PTP ioctl regardless of whether ena_com_phc_get_timestamp() succeeded. If an error occurs (e.g., PHC disabled or blocked), the timestamp could contain uninitialized memory or...

CVE-2026-63837

In the Linux kernel, the following vulnerability has been resolved: net: ena: PHC: Check return code before setting timestamp output enaphcgettimex64 is setting the output parameter regardless of whether enacomphcgettimestamp succeeded or failed. When enacomphcgettimestamp returns an error, the...

PT-2026-61479

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the idpf ptp init function where the read dev clk lock spinlock is initialized after the ptp schedule worker function has been called. This sequence allows the PTP...

CVE-2026-54466

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, the frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitrarily large integer to be encoded as a sequence of bytes with the high bit set. By sending an indefinite...

EUVD-2026-45335

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, the frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitrarily large integer to be encoded as a sequence of bytes with the high bit set. By sending an indefinite...