SB20260919120 - Numeric Truncation Error in Linux kernel ptp driver

Description

This security bulletin contains information about 1 vulnerability.

1) Numeric Truncation Error (CVE-ID: CVE-2026-90100)

CWE-ID: CWE-197 - Numeric Truncation Error

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to numeric truncation in the NETC PTP PEROUT configuration handling when configuring periodic output with an oversized period. A local user can configure a period that is truncated to zero to cause a denial of service.

The divide-by-zero condition is reached when the configured start time is {0, 0}; a zero period can also cause unsigned wraparound when programming the FIPER register.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/08988d1941e180f0ad30d91233cb64f3418ba23c
• https://git.kernel.org/stable/c/51fe3fe0ffec033bd831c71d9bee3dee827e491c
• https://git.kernel.org/stable/c/777dbc9914b2f003f1d44af80c7a4a395c5961b2