CVE-2026-80724
Description
A flaw was found in the Linux kernel's vmclock component. This vulnerability allows a guest operating system, through a userspace process, to change a shared memory page from read-only to writable. This occurs because the vmclock_miscdev_mmap() function fails to properly restrict permission upgrades. As a result, the guest can corrupt critical host-written timekeeping data, such as the sequence counter and Coordinated Universal Time (UTC), leading to data integrity issues.
Statement
A flaw of MODERATE severity was found in the Linux kernel's ptp/vmclock driver, which is used for host-to-guest time synchronization in virtual machines. The vmclock_miscdev_mmap() function rejects writable mappings of the shared vmclock ABI page but leaves the VM_MAYWRITE flag set, so an unprivileged userspace process running in a guest can map the page read-only and then upgrade the mapping to writable with mprotect(). This allows the guest to corrupt host-written timekeeping data that the vmclock ABI defines as read-only, such as the sequence counter, UTC time, and TSC offset, resulting in corruption of timekeeping data used by the guest. Red Hat Product Security rated this flaw MODERATE (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because exploitation requires local access within a guest and the impact is limited to integrity and availability of guest timekeeping data without a scope change. This differs from the upstream CVEORG rating of IMPORTANT (CVSS 8.8), which assumes a scope change and high confidentiality impact. All Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel streams currently tracked for this flaw are recorded as NOT AFFECTED because the vulnerable code is not present in the shipped kernel versions, so no Red Hat products require an update for this issue.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | 8.8 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Changed |
| Confidentiality | None | N/A | High |
| Integrity Impact | None | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Understanding the Weakness (CWE)
Confidentiality,Integrity
Technical Impact: Read Application Data; Modify Application Data
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
