CVE-2026-80724

A flaw was found in the Linux kernel's vmclock component. This vulnerability allows a guest operating system, through a userspace process, to change a shared memory page from read-only to writable. This occurs because the vmclock_miscdev_mmap() function fails to properly restrict permission upgrades. As a result, the guest can corrupt critical host-written timekeeping data, such as the sequence counter and Coordinated Universal Time (UTC), leading to data integrity issues.

A flaw of MODERATE severity was found in the Linux kernel's ptp/vmclock driver, which is used for host-to-guest time synchronization in virtual machines. The vmclock_miscdev_mmap() function rejects writable mappings of the shared vmclock ABI page but leaves the VM_MAYWRITE flag set, so an unprivileged userspace process running in a guest can map the page read-only and then upgrade the mapping to writable with mprotect(). This allows the guest to corrupt host-written timekeeping data that the vmclock ABI defines as read-only, such as the sequence counter, UTC time, and TSC offset, resulting in corruption of timekeeping data used by the guest. Red Hat Product Security rated this flaw MODERATE (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because exploitation requires local access within a guest and the impact is limited to integrity and availability of guest timekeeping data without a scope change. This differs from the upstream CVEORG rating of IMPORTANT (CVSS 8.8), which assumes a scope change and high confidentiality impact. All Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel streams currently tracked for this flaw are recorded as NOT AFFECTED because the vulnerable code is not present in the shipped kernel versions, so no Red Hat products require an update for this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.