CVE-2026-80724: 
Linux Debian Analyse et atténuation des vulnérabilités

CVE-2026-80724 is a tampering vulnerability in the Linux kernel's ptp: vmclock subsystem that allows a local user to upgrade a read-only memory mapping to writable, enabling corruption of host-written timekeeping data. The flaw was published on August 28, 2026, and affects Linux kernel versions starting from 6.13 up to (but not including) the patched stable releases. Fixed versions include 6.18.47, 7.1.11, and 7.2.1. The CVSS base score is listed as 0.0 (severity not yet formally rated), with Feedly estimating it as Medium severity (Github Advisory, Feedly).

The root cause is an incomplete access control enforcement in vmclock_miscdev_mmap(): the function correctly rejects writable mappings of the shared vmclock ABI page with -EROFS, but fails to clear the VM_MAYWRITE flag on the resulting VMA (CWE classification not formally assigned). Because VM_MAYWRITE remains set, userspace can first map the page read-only and then call mprotect() to upgrade the mapping to writable — bypassing the original restriction. Once writable, a guest process can corrupt host-written timekeeping fields (sequence counter, UTC time, TSC offset) that the vmclock ABI designates as read-only. The fix mirrors the approach used in the i915 driver for read-only objects and patches previously applied to drm/vc4 (CVE-2026-68445) and drm/panthor (CVE-2024-53071) (Github Advisory).

A local attacker with access to the vmclock device can corrupt the shared timekeeping page, including the sequence counter, UTC time, and TSC offset. This integrity violation can cause guest-side time synchronization failures, undermine time-dependent security mechanisms (e.g., certificate validation, log timestamping, Kerberos authentication), and potentially destabilize workloads relying on accurate clock readings in virtualized environments. The vulnerability does not directly enable code execution or privilege escalation, but the integrity impact on host-written data shared across the guest/host boundary is significant in multi-tenant virtualization scenarios (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (Feedly). The EPSS score is 0.0, reflecting very low current exploitation probability (Github Advisory). The vulnerability requires local access to the vmclock device, limiting the attack surface to processes running within a guest VM that have access to the miscdevice. CVE-2026-80724 is not listed in the CISA Known Exploited Vulnerabilities catalog.

1. Gain local access: Obtain execution as a local user within a Linux guest VM running a vulnerable kernel (6.13 ≤ version < 6.18.47 / 7.1.11 / 7.2.1) with access to the vmclock miscdevice (e.g., /dev/vmclock0).
2. Map the page read-only: Open the vmclock device and call mmap() with PROT_READ only, which succeeds because the kernel allows read-only mappings.
3. Upgrade to writable via mprotect(): Call mprotect() on the mapped region with PROT_READ | PROT_WRITE. Because VM_MAYWRITE was not cleared, the kernel permits this upgrade.
4. Corrupt timekeeping data: Write arbitrary values to the now-writable page, overwriting the sequence counter, UTC time, or TSC offset fields that the vmclock ABI defines as host-controlled read-only data.
5. Achieve impact: Cause time synchronization failures, undermine time-sensitive security checks, or disrupt other guests or host processes that rely on the shared vmclock ABI page (Github Advisory, Feedly).

• Process Behavior: Unexpected calls to mprotect() on memory regions mapped from /dev/vmclock0 or similar vmclock miscdevice nodes, particularly upgrading from PROT_READ to PROT_READ|PROT_WRITE.
• Logs: Kernel audit logs (auditd) showing mmap and mprotect syscalls targeting the vmclock device file descriptor from unprivileged processes.
• File System: Unusual access patterns to /dev/vmclock* device nodes by non-privileged or unexpected user accounts.
• System Behavior: Unexplained time jumps, sequence counter anomalies, or NTP/PTP synchronization errors on guest VMs that could indicate corruption of the vmclock ABI page.

Apply the Linux kernel patches that clear VM_MAYWRITE on read-only vmclock mappings in vmclock_miscdev_mmap(). Fixed versions are 6.18.47, 7.1.11, and 7.2.1 (Github Advisory). The specific fix commits are 5b4f2bec7bea, 2496e1418271, and 2e596e7814ba on the stable kernel tree. As a workaround prior to patching, restrict access to the vmclock miscdevice (/dev/vmclock*) to trusted processes only using file permissions or Linux Security Module (LSM) policies such as SELinux or AppArmor.