---
id: CVE-2026-80724
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ptp: vmclock: prevent read-only mappings from becoming writable

  vmclock_miscdev_mmap() rejects writable mappings of the shared vmclock
  ABI page with -EROFS, but leaves…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ptp: vmclock: prevent read-only mappings from becoming writable

  vmclock_miscdev_mmap() rejects writable mappings of the shared vmclock
  ABI page with -EROFS, but leaves…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 20503272422693d793b84f88bf23fe4e955d3a33 <
    5b4f2bec7bea6c04084d720d731bedee7caf878d
  - >-
    Linux >= 20503272422693d793b84f88bf23fe4e955d3a33 <
    3f5677d2f817355147337f0453174c7bb0f3b66a
  - >-
    Linux >= 20503272422693d793b84f88bf23fe4e955d3a33 <
    2496e141827102d6af512950057d402a2cfb2bfc
  - >-
    Linux >= 20503272422693d793b84f88bf23fe4e955d3a33 <
    2e596e7814ba38cdc129991058b6c254ed37cb11
  - >-
    Linux >= 20503272422693d793b84f88bf23fe4e955d3a33 <
    0ce59c4148ecd1520c5592a63bb3c8991ee2d326
  - >-
    Linux >= 20503272422693d793b84f88bf23fe4e955d3a33 <
    a5edadbae57e2298a56cf7a4e774a027905a331f
  - Linux 6.13
published: '2026-08-28'
updated: '2026-09-07'
sourceUpdated: '2026-09-07T16:17:29.930'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-80724'
references:
  - url: 'https://git.kernel.org/stable/c/0ce59c4148ecd1520c5592a63bb3c8991ee2d326'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/2496e141827102d6af512950057d402a2cfb2bfc'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/2e596e7814ba38cdc129991058b6c254ed37cb11'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/3f5677d2f817355147337f0453174c7bb0f3b66a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/5b4f2bec7bea6c04084d720d731bedee7caf878d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a5edadbae57e2298a56cf7a4e774a027905a331f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00176
epssPercentile: 0.06293
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/suruurism/cve-writeups-and-pocs'
  checkedAt: '2026-09-25T08:21:15.436Z'
exploitAvailable: true
ingestedAt: '2026-08-31T08:05:08.586Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ptp: vmclock: prevent read-only mappings from becoming writable

vmclock_miscdev_mmap() rejects writable mappings of the shared vmclock
ABI page with -EROFS, but leaves VM_MAYWRITE set.  Userspace can map the
page read-only and then upgrade it to writable with mprotect(), after
which the guest can corrupt the host-written timekeeping data (sequence
counter, UTC time, TSC offset) that the vmclock ABI defines as read-only.

Clear VM_MAYWRITE on the read-only path so the mapping cannot be
upgraded, as i915 does for its read-only objects and as fixed in drm/vc4
(CVE-2026-68445) and drm/panthor (CVE-2024-53071).

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.