CVE-2026-63837

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63837", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.015Z", "datePublished": "2026-07-19T14:04:33.781Z", "dateUpdated": "2026-07-19T14:04:33.781Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-07-19T14:04:33.781Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ena: PHC: Check return code before setting timestamp output\n\nena_phc_gettimex64() is setting the output parameter regardless\nof whether ena_com_phc_get_timestamp() succeeded or failed.\n\nWhen ena_com_phc_get_timestamp() returns an error, the timestamp\nparameter may contain uninitialized stack memory (e.g., when PHC is\ndisabled or in blocked state) or invalid hardware values. Passing\nthese to userspace via the PTP ioctl is both a security issue\n(information leak) and a correctness bug.\n\nFix by checking the return code after releasing the lock and only\nsetting the output timestamp on success."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/amazon/ena/ena_phc.c"], "versions": [{"version": "e0ea34158ee8c4f7536cd781010339ff28c0d24c", "lessThan": "bddf59818ae5102e6d82a4dae5add6df8da38fb0", "status": "affected", "versionType": "git"}, {"version": "e0ea34158ee8c4f7536cd781010339ff28c0d24c", "lessThan": "edcb049d836e175e7b3d5e0d05657104545b5e65", "status": "affected", "versionType": "git"}, {"version": "e0ea34158ee8c4f7536cd781010339ff28c0d24c", "lessThan": "24a08d7d6218d60c033015cf4870b6096446e734", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/amazon/ena/ena_phc.c"], "versions": [{"version": "6.17", "status": "affected"}, {"version": "0", "lessThan": "6.17", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.33", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.10", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "6.18.33"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "7.0.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/bddf59818ae5102e6d82a4dae5add6df8da38fb0"}, {"url": "https://git.kernel.org/stable/c/edcb049d836e175e7b3d5e0d05657104545b5e65"}, {"url": "https://git.kernel.org/stable/c/24a08d7d6218d60c033015cf4870b6096446e734"}], "title": "net: ena: PHC: Check return code before setting timestamp output", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/amazon/ena/ena_phc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "bddf59818ae5102e6d82a4dae5add6df8da38fb0", "status": "affected", "version": "e0ea34158ee8c4f7536cd781010339ff28c0d24c", "versionType": "git"}, {"lessThan": "edcb049d836e175e7b3d5e0d05657104545b5e65", "status": "affected", "version": "e0ea34158ee8c4f7536cd781010339ff28c0d24c", "versionType": "git"}, {"lessThan": "24a08d7d6218d60c033015cf4870b6096446e734", "status": "affected", "version": "e0ea34158ee8c4f7536cd781010339ff28c0d24c", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/amazon/ena/ena_phc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.17"}, {"lessThan": "6.17", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.33", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4F0E1027-1081-4E2B-9D56-AF79BAFF146B", "versionEndExcluding": "6.18.33", "versionStartIncluding": "6.17", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A13475D2-59BF-4716-94B5-7C1D239A2CF4", "versionEndExcluding": "7.0.10", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*", "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ena: PHC: Check return code before setting timestamp output\n\nena_phc_gettimex64() is setting the output parameter regardless\nof whether ena_com_phc_get_timestamp() succeeded or failed.\n\nWhen ena_com_phc_get_timestamp() returns an error, the timestamp\nparameter may contain uninitialized stack memory (e.g., when PHC is\ndisabled or in blocked state) or invalid hardware values. Passing\nthese to userspace via the PTP ioctl is both a security issue\n(information leak) and a correctness bug.\n\nFix by checking the return code after releasing the lock and only\nsetting the output timestamp on success."}], "id": "CVE-2026-63837", "lastModified": "2026-11-12T19:59:30.547", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-07-19T15:16:50.480", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/24a08d7d6218d60c033015cf4870b6096446e734"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/bddf59818ae5102e6d82a4dae5add6df8da38fb0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/edcb049d836e175e7b3d5e0d05657104545b5e65"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-667"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: net: ena: PHC: Check return code before setting timestamp output", "id": "2502306", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502306"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-201", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet: ena: PHC: Check return code before setting timestamp output\nena_phc_gettimex64() is setting the output parameter regardless\nof whether ena_com_phc_get_timestamp() succeeded or failed.\nWhen ena_com_phc_get_timestamp() returns an error, the timestamp\nparameter may contain uninitialized stack memory (e.g., when PHC is\ndisabled or in blocked state) or invalid hardware values. Passing\nthese to userspace via the PTP ioctl is both a security issue\n(information leak) and a correctness bug.\nFix by checking the return code after releasing the lock and only\nsetting the output timestamp on success.", "A flaw was found in the Linux kernel's Elastic Network Adapter (ENA) driver. The driver's Precision Time Protocol (PTP) Hardware Clock (PHC) support, specifically the `ena_phc_gettimex64()` function, fails to check the return code of an internal timestamp retrieval function. This oversight can lead to uninitialized or invalid memory being passed to userspace applications through the PTP ioctl, resulting in an information leak. This vulnerability allows a local user to potentially gain access to sensitive system information."], "name": "CVE-2026-63837", "public_date": "2026-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-63837\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-63837\nhttps://lore.kernel.org/linux-cve-announce/2026071926-CVE-2026-63837-55cd@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e0ea34158ee8c4f7536cd781010339ff28c0d24c,bddf59818ae5102e6d82a4dae5add6df8da38fb0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e0ea34158ee8c4f7536cd781010339ff28c0d24c,edcb049d836e175e7b3d5e0d05657104545b5e65)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e0ea34158ee8c4f7536cd781010339ff28c0d24c,24a08d7d6218d60c033015cf4870b6096446e734)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.17"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.17)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.33,6.19.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0.10,7.1.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-21T13:15:04.896639+00:00", "updated": "2026-07-30T22:15:13.594970+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}