[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-DEBIAN-CVE-2026-31396":6},{"stargazers_count":4,"fetched_at":5},7,"2026-07-30T21:17:53.703Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":11,"aliases":12,"duplicate_of":9,"upstream":13,"downstream":16,"duplicates":17,"related":18,"reserved_at":9,"published_at":19,"modified_at":20,"state":9,"summary":21,"references_raw":23,"kevs":30,"epss":9,"epss_history":31,"metrics":32,"affected":39},"DEBIAN-CVE-2026-31396","In the Linux kernel, the following vulnerability has been resolved:  net: macb: fix use-after-free access to PTP clock  PTP clock is registered on every opening of the interface and destroyed on every closing.  However it may be accessed via get_ts_info ethtool call which is possible while the interface is just present in the kernel.  BUG: KASAN: use-after-free in ptp_clock_index+0x47/0x50 drivers/ptp/ptp_clock.c:426 Read of size 4 at addr ffff8880194345cc by task syz.0.6/948  CPU: 1 PID: 948 Comm: syz.0.6 Not tainted 6.1.164+ #109 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.1-0-g3208b098f51a-prebuilt.qemu.org 04/01/2014 Call Trace:  \u003CTASK>  __dump_stack lib/dump_stack.c:88 [inline]  dump_stack_lvl+0x8d/0xba lib/dump_stack.c:106  print_address_description mm/kasan/report.c:316 [inline]  print_report+0x17f/0x496 mm/kasan/report.c:420  kasan_report+0xd9/0x180 mm/kasan/report.c:524  ptp_clock_index+0x47/0x50 drivers/ptp/ptp_clock.c:426  gem_get_ts_info+0x138/0x1e0 drivers/net/ethernet/cadence/macb_main.c:3349  macb_get_ts_info+0x68/0xb0 drivers/net/ethernet/cadence/macb_main.c:3371  __ethtool_get_ts_info+0x17c/0x260 net/ethtool/common.c:558  ethtool_get_ts_info net/ethtool/ioctl.c:2367 [inline]  __dev_ethtool net/ethtool/ioctl.c:3017 [inline]  dev_ethtool+0x2b05/0x6290 net/ethtool/ioctl.c:3095  dev_ioctl+0x637/0x1070 net/core/dev_ioctl.c:510  sock_do_ioctl+0x20d/0x2c0 net/socket.c:1215  sock_ioctl+0x577/0x6d0 net/socket.c:1320  vfs_ioctl fs/ioctl.c:51 [inline]  __do_sys_ioctl fs/ioctl.c:870 [inline]  __se_sys_ioctl fs/ioctl.c:856 [inline]  __x64_sys_ioctl+0x18c/0x210 fs/ioctl.c:856  do_syscall_x64 arch/x86/entry/common.c:46 [inline]  do_syscall_64+0x35/0x80 arch/x86/entry/common.c:76  entry_SYSCALL_64_after_hwframe+0x6e/0xd8  \u003C/TASK>  Allocated by task 457:  kmalloc include/linux/slab.h:563 [inline]  kzalloc include/linux/slab.h:699 [inline]  ptp_clock_register+0x144/0x10e0 drivers/ptp/ptp_clock.c:235  gem_ptp_init+0x46f/0x930 drivers/net/ethernet/cadence/macb_ptp.c:375  macb_open+0x901/0xd10 drivers/net/ethernet/cadence/macb_main.c:2920  __dev_open+0x2ce/0x500 net/core/dev.c:1501  __dev_change_flags+0x56a/0x740 net/core/dev.c:8651  dev_change_flags+0x92/0x170 net/core/dev.c:8722  do_setlink+0xaf8/0x3a80 net/core/rtnetlink.c:2833  __rtnl_newlink+0xbf4/0x1940 net/core/rtnetlink.c:3608  rtnl_newlink+0x63/0xa0 net/core/rtnetlink.c:3655  rtnetlink_rcv_msg+0x3c6/0xed0 net/core/rtnetlink.c:6150  netlink_rcv_skb+0x15d/0x430 net/netlink/af_netlink.c:2511  netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]  netlink_unicast+0x6d7/0xa30 net/netlink/af_netlink.c:1344  netlink_sendmsg+0x97e/0xeb0 net/netlink/af_netlink.c:1872  sock_sendmsg_nosec net/socket.c:718 [inline]  __sock_sendmsg+0x14b/0x180 net/socket.c:730  __sys_sendto+0x320/0x3b0 net/socket.c:2152  __do_sys_sendto net/socket.c:2164 [inline]  __se_sys_sendto net/socket.c:2160 [inline]  __x64_sys_sendto+0xdc/0x1b0 net/socket.c:2160  do_syscall_x64 arch/x86/entry/common.c:46 [inline]  do_syscall_64+0x35/0x80 arch/x86/entry/common.c:76  entry_SYSCALL_64_after_hwframe+0x6e/0xd8  Freed by task 938:  kasan_slab_free include/linux/kasan.h:177 [inline]  slab_free_hook mm/slub.c:1729 [inline]  slab_free_freelist_hook mm/slub.c:1755 [inline]  slab_free mm/slub.c:3687 [inline]  __kmem_cache_free+0xbc/0x320 mm/slub.c:3700  device_release+0xa0/0x240 drivers/base/core.c:2507  kobject_cleanup lib/kobject.c:681 [inline]  kobject_release lib/kobject.c:712 [inline]  kref_put include/linux/kref.h:65 [inline]  kobject_put+0x1cd/0x350 lib/kobject.c:729  put_device+0x1b/0x30 drivers/base/core.c:3805  ptp_clock_unregister+0x171/0x270 drivers/ptp/ptp_clock.c:391  gem_ptp_remove+0x4e/0x1f0 drivers/net/ethernet/cadence/macb_ptp.c:404  macb_close+0x1c8/0x270 drivers/net/ethernet/cadence/macb_main.c:2966  __dev_close_many+0x1b9/0x310 net/core/dev.c:1585  __dev_close net/core/dev.c:1597 [inline]  __dev_change_flags+0x2bb/0x740 net/core/dev.c:8649  dev_change_fl ---truncated---",null,[],[],[],[14],{"_key":15},"CVE-2026-31396",[],[],[],"2026-04-03T16:16:37.887Z","2026-06-15T19:06:15.246148929Z",{"cisa_kev":22,"cisa_ransomware":22,"cisa_vendor":9,"epss_severity":9,"epss_score":9,"severity":9,"severity_score":9,"severity_version":9,"severity_source":9,"severity_vector":9,"severity_status":9},false,[24],{"url":25,"sources":26,"tags":28},"https://security-tracker.debian.org/tracker/CVE-2026-31396",[27],"osv_debian",[29],"Advisory",[],[],[33],{"source":27,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":34,"cvss_v4_0":9},{"baseScore":35,"baseSeverity":9,"vectorString":36,"impactScore":37,"exploitabilityScore":38},7.8,"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",9.8,4.6,[40,65],{"ecosystem":41,"name":42,"vendor":43,"product":42,"cpe_part":9,"purl_type":44,"purl_namespace":43,"purl_name":42,"source":9,"versions":45},"Debian","linux","debian","deb",[46,50,51,52,56,59,62],{"version":47,"is_range":48,"range_type":49,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},"all",true,"ecosystem",{"version":47,"is_range":48,"range_type":49,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":47,"is_range":48,"range_type":49,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":53,"is_range":48,"range_type":49,"version_start":9,"version_start_type":9,"version_end":54,"version_end_type":55,"fixed_in":9},"lt5_10_257_1","5.10.257-1","excluding",{"version":57,"is_range":48,"range_type":49,"version_start":9,"version_start_type":9,"version_end":58,"version_end_type":55,"fixed_in":9},"lt6_1_170_1","6.1.170-1",{"version":60,"is_range":48,"range_type":49,"version_start":9,"version_start_type":9,"version_end":61,"version_end_type":55,"fixed_in":9},"lt6_12_85_1","6.12.85-1",{"version":63,"is_range":48,"range_type":49,"version_start":9,"version_start_type":9,"version_end":64,"version_end_type":55,"fixed_in":9},"lt6_19_10_1","6.19.10-1",{"ecosystem":41,"name":66,"vendor":43,"product":66,"cpe_part":9,"purl_type":44,"purl_namespace":43,"purl_name":66,"source":9,"versions":67},"linux-6.1",[68],{"version":69,"is_range":48,"range_type":49,"version_start":9,"version_start_type":9,"version_end":70,"version_end_type":55,"fixed_in":9},"lt6_1_170_1~deb11u1","6.1.170-1~deb11u1"]