7.8

CVE-2026-80991: linux

CVSS: 7.8v3.1HighReceived
AliasesUBUNTU-CVE-2026-80991DEBIAN-CVE-2026-80991
Published 11-09-2026Last modified 21-10-2026
Open JSON

Vulnerability summary

CVE-2026-80991 is a high (CVSS 7.8) vulnerability in linux. EPSS estimates a 0.16% chance of exploitation in the next 30 days, higher than 5.2% of scored vulnerabilities.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.16%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 1
OPENSUSE-SU-2026:11805-1

Timeline

  1. 11-09-2026
    PublishedVulnerability first disclosed.
  2. 21-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: net: ravb: serialize PTP clock teardown ravb_ptp_interrupt() can race with ravb_ptp_stop() and pass the clock to ptp_clock_event() while ptp_clock_unregister() is freeing it. This can lead to a use-after-free. Use READ_ONCE() and WRITE_ONCE() for lockless access to the clock pointer. Atomically detach it with xchg() before disabling PTP interrupts, then synchronize all IRQs which can invoke ravb_ptp_interrupt() before unregistering the detached clock. A handler which read the old pointer completes before the clock is unregistered, while later handlers read NULL and skip the event.

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

0.16%

Chance of exploitation in the next 30 days

Percentile

5%

Versus all other CVEs

30-day change

0.00 pp

From 0.16% on 21-09-2026

21-09-202621-10-2026
EPSS score
0.16%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu169 products
  • linuxAll versions (No fix recorded)
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded)
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian2 products
  • linuxAll versions (No fix recorded) | < 6.12.111-1 | < 7.2.6-1
  • linux-6.12< 6.12.111-1~deb12u1
Linux1 product
  • linux≥ a0d2f20650e81407d8e51ad2cbdc492861c74e9c, < b917f37bfcce919a969d66a044580a95b11df31c | ≥ a0d2f20650e81407d8e51ad2cbdc492861c74e9c, < 695acb5534a9e366efb47b40c7487fc56488b09b | ≥ a0d2f20650e81407d8e51ad2cbdc492861c74e9c, < 67a82e6f886beed0de8f8da08bb767e68fba952d | ≥ a0d2f20650e81407d8e51ad2cbdc492861c74e9c, < 66b50c31419e7946e9aa325a468ad9b64c961a25 | ≥ a0d2f20650e81407d8e51ad2cbdc492861c74e9c, < 1cb9663789c5b7a12fcd419fcca6d6254c398252 | 4.2

3 vendors · 172 products

References

9 links