Numeric Truncation Error in Linux kernel - CVE-2026-90100

Vulnerability identifier: #VU151388

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-90100

CWE-ID: CWE-197

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to numeric truncation in the NETC PTP PEROUT configuration handling when configuring periodic output with an oversized period. A local user can configure a period that is truncated to zero to cause a denial of service.

The divide-by-zero condition is reached when the configured start time is {0, 0}; a zero period can also cause unsigned wraparound when programming the FIPER register.

Linux kernel
Ubuntu
linux (Ubuntu package)
linux-aws (Ubuntu package)
linux-gcp (Ubuntu package)
linux-oracle (Ubuntu package)
linux-ibm (Ubuntu package)
linux-hwe-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)

Install security update from vendor's repository.

linux (Ubuntu package) - update to 7.0.0-42.42
linux-aws (Ubuntu package) - update to 7.0.0-1016.17
linux-gcp (Ubuntu package) - update to 7.0.0-1016.18
linux-oracle (Ubuntu package) - update to 7.0.0-1015.16
linux-ibm (Ubuntu package) - update to 7.0.0-1017.17
linux-hwe-7.0 (Ubuntu package) - update to 7.0.0-42.42~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1017.17

• https://git.kernel.org/stable/c/08988d1941e180f0ad30d91233cb64f3418ba23c
• https://git.kernel.org/stable/c/51fe3fe0ffec033bd831c71d9bee3dee827e491c
• https://git.kernel.org/stable/c/777dbc9914b2f003f1d44af80c7a4a395c5961b2

• Numeric Truncation Error in Linux kernel ptp driver
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux, linux-aws, linux-gcp and more