CVE-2026-80564

A flaw was found in the Linux kernel's gve component. A local user can trigger a NULL pointer dereference by attempting to use the ptp adjfine function, which has a missing implementation. This vulnerability can lead to a system crash, resulting in a Denial of Service (DoS).

A low-impact NULL pointer dereference flaw was found in the Linux kernel's gve (Google Virtual Ethernet) driver PTP clock support. The gve driver registered a PTP clock without implementing the adjfine callback, so a frequency-adjustment request made through the clock_adjtime() syscall on the exposed /dev/ptp device (for example, running testptp -d /dev/ptp0 -f 0) causes the kernel to call a NULL function pointer, resulting in a kernel panic and a denial of service. Exploiting this flaw requires local access with privileges sufficient to program the PTP clock (typically root or CAP_SYS_TIME), and only availability is affected: there is no impact on confidentiality or integrity. Red Hat Product Security rates this flaw Low severity, lower than the moderate CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) suggests, because triggering the crash requires privileged local access and the sole consequence is a system crash. The vulnerable gve PTP code is present only in Red Hat Enterprise Linux 10.3 and 10.4 and in Red Hat In-Vehicle OS 2.0 and 2.1 kernels (kernel and kernel-ivos-qualcomm); earlier RHEL releases and the rhel-10.0.z and rhel-10.2.z update streams do not contain the gve PTP support that introduced this flaw and are therefore not affected. For the affected streams, the fix is deferred because this is a privilege-gated local denial of service with no confidentiality or integrity impact; the residual risk of the delay is limited to a privileged local user being able to crash the system.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.