CVE-2026-80564

A low-impact NULL pointer dereference flaw was found in the Linux kernel's gve (Google Virtual Ethernet) driver PTP clock support. The gve driver registered a PTP clock without implementing the adjfine callback, so a frequency-adjustment request made through the clock_adjtime() syscall on the exposed /dev/ptp device (for example, running testptp -d /dev/ptp0 -f 0) causes the kernel to call a NULL function pointer, resulting in a kernel panic and a denial of service. Exploiting this flaw requires local access with privileges sufficient to program the PTP clock (typically root or CAP_SYS_TIME), and only availability is affected: there is no impact on confidentiality or integrity. Red Hat Product Security rates this flaw Low severity, lower than the moderate CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) suggests, because triggering the crash requires privileged local access and the sole consequence is a system crash. The vulnerable gve PTP code is present only in Red Hat Enterprise Linux 10.3 and 10.4 and in Red Hat In-Vehicle OS 2.0 and 2.1 kernels (kernel and kernel-ivos-qualcomm); earlier RHEL releases and the rhel-10.0.z and rhel-10.2.z update streams do not contain the gve PTP support that introduced this flaw and are therefore not affected. For the affected streams, the fix is deferred because this is a privilege-gated local denial of service with no confidentiality or integrity impact; the residual risk of the delay is limited to a privileged local user being able to crash the system.