PT-2026-61479 · Linux · Linux

CVE-2026-64162 · Published 2026-07-19 · Updated 2026-07-19

NVD

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In the Linux kernel, the following vulnerability has been resolved:

idpf: fix read dev clk lock spinlock init in idpf ptp init()

In idpf ptp init(), read dev clk lock is initialized after ptp schedule worker() had already been called (and after idpf ptp settime64() could reach the lock). The PTP aux worker fires immediately upon scheduling and can call into idpf ptp read src clk reg direct(), which takes spin lock(&ptp->read dev clk lock) on an uninitialized lock, triggering the lockdep "non-static key" warning:

[12973.796587] idpf 0000:83:00.0: Device HW Reset initiated [12974.094507] INFO: trying to register non-static key. ... [12974.097208] Call Trace: [12974.097213] [12974.097218] dump stack lvl+0x93/0xe0 [12974.097234] register lock class+0x4c4/0x4e0 [12974.097249] ? lock acquire+0x427/0x2290 [12974.097259] lock acquire+0x98/0x2290 [12974.097272] lock acquire+0xc6/0x310 [12974.097281] ? idpf ptp read src clk reg+0xb7/0x150 [idpf] [12974.097311] ? lockdep hardirqs on prepare+0xde/0x190 [12974.097318] ? finish task switch.isra.0+0xd2/0x350 [12974.097330] ? pfx ptp aux kworker+0x10/0x10 [ptp] [12974.097343] raw spin lock+0x30/0x40 [12974.097353] ? idpf ptp read src clk reg+0xb7/0x150 [idpf] [12974.097373] idpf ptp read src clk reg+0xb7/0x150 [idpf] [12974.097391] ? kthread worker fn+0x88/0x3d0 [12974.097404] ? kthread worker fn+0x4e/0x3d0 [12974.097411] idpf ptp update cached phctime+0x26/0x120 [idpf] [12974.097428] ? raw spin unlock irq+0x28/0x50 [12974.097436] idpf ptp do aux work+0x15/0x20 [idpf] [12974.097454] ptp aux kworker+0x20/0x40 [ptp] [12974.097464] kthread worker fn+0xd5/0x3d0 [12974.097474] ? pfx kthread worker fn+0x10/0x10 [12974.097482] kthread+0xf4/0x130 [12974.097489] ? pfx kthread+0x10/0x10 [12974.097498] ret from fork+0x32c/0x410 [12974.097512] ? pfx kthread+0x10/0x10 [12974.097519] ret from fork asm+0x1a/0x30 [12974.097540]

Move the call to spin lock init() up a bit to make sure read dev clk lock is not touched before it's been initialized.

Fix

Related Identifiers

CVE-2026-64162

Affected Products

Linux

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-64162 · Security Note
• https://git.kernel.org/stable/c/da4f76b6a84ede14a71282ef841768299ead0221 · Note
• https://git.kernel.org/stable/c/3122d70b7c0101d897fb795658a7b93f854935f2 · Note
• https://git.kernel.org/stable/c/eb5991d4c8ba2e8153dfcda3e66a9608377b7dce · Note