Remote kernel-state corruption via uninitialized idpf spinlock
Published Jul 19, 2026 · Updated Jul 19, 2026
Missing spinlock initialization in affected Linux Kernel releases allows remote attackers to corrupt kernel state via crafted traffic. idpf_ptp_init schedules the PTP auxiliary worker before initializing read_dev_clk_lock, so the worker or idpf_ptp_settime64 can acquire an uninitialized lock. Exploitation requires an idpf-managed NIC with device-clock access; the resulting unsynchronized execution can disclose data, corrupt timing state, or cause a kernel deadlock, oops, or hang.
Summary
What happened
Missing spinlock initialization in affected Linux Kernel releases allows remote attackers to corrupt kernel state via crafted traffic. idpf_ptp_init schedules the PTP auxiliary worker before initializing read_dev_clk_lock, so the worker or idpf_ptp_settime64 can acquire an uninitialized lock. Exploitation requires an idpf-managed NIC with device-clock access; the resulting unsynchronized execution can disclose data, corrupt timing state, or cause a kernel deadlock, oops, or hang.
The record
- CVE
- CVE-2026-64162
- Published
- Jul 19, 2026
- Updated
- Jul 19, 2026
- Vendor
- The Linux Kernel Organization
- Product
- Linux Kernel
- Classifications
- T1499.004
- Attack vector
- network
- Privileges
- unauthenticated
Timeline
How it unfolded
- Jul 19, 2026CVE publishedPublication date reported by the CVE source.
- Jul 19, 2026Record updatedLatest update available in the CVE record.
Exploitability
Present is not the same as exploitable
Compare your product and version with the public record. A matching version still requires validation against your environment.
Is a vulnerable build present?
Compare these published version ranges with your installed build and any vendor patches.
- Affected versionversion=5cb8805d2366b20ee4d7afff586d8acf17649330 <3122d70b7c0101d897fb795658a7b93f854935f2
- Affected versionversion=5cb8805d2366b20ee4d7afff586d8acf17649330 <da4f76b6a84ede14a71282ef841768299ead0221
- Affected versionversion=5cb8805d2366b20ee4d7afff586d8acf17649330 <eb5991d4c8ba2e8153dfcda3e66a9608377b7dce
- Affected versionversion=6.16
What conditions does exploitation require?
What is affected?
Published CVSS scores
CVSS describes severity. EPSS estimates exploitation probability.
Attacks
What attackers are doing with it
Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.
Weakness, pattern, technique
Public exploit references
No public exploit references are available in this record.
Labels summarize the accepted research assessment. They do not indicate a test against your environment.
Technologies
Your stack
See the directory against your own environment.
Your stack
Check the software in your environment
Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.
Book a demo