CVE-2026-68134

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-68134", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-30T09:28:09.370Z", "datePublished": "2026-08-10T11:58:57.504Z", "dateUpdated": "2026-08-17T04:59:26.371Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T04:59:26.371Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nptp: ptp_s390: Add missing facility check\n\nOnly register the physical clock when facility 28 is installed\nand PTFF QAF returns that PTFF QPT is available."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "baseScore": 7.3, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached only via local PTP character-device access: open(/dev/ptpX) followed by ioctl paths such as PTP_SYS_OFFSET or clock_gettime on the posix clock FD, which call ptp_s390_qpt_gettime() and execute the PTFF instruction in kernel context.\nAC:L - On affected IBM Z systems with the s390 PTP driver enabled, any process that can open the physical-clock device can repeatedly issue read ioctls that deterministically invoke PTFF without races or attacker-uncontrollable timing.\nPR:L - PTP read ioctls and clock_gettime do not require CAP_SYS_TIME; on typical chrony/ptp4l and containerized time-sync deployments /dev/ptp* is often opened by non-root service accounts or passed into unprivileged workloads, not only init-namespace root.\nUI:N - Exploitation requires only the attacker (or their service account) opening the PTP device and issuing ioctls; no separate victim action such as mounting a filesystem or clicking a prompt is needed.\nS:U - Impact is confined to the same Linux kernel running the ptp_s390 driver on the s390 host; it does not cross a VM, IOMMU, or other security boundary to another authority.\nC:H - When PTFF QPT is unavailable the driver still calls ptff() and returns the unchecked stack buffer to userspace, leaking kernel memory; on systems without facility 28 the illegal PTFF traps in kernel mode and can expose register/state data during the fault path.\nI:L - Returning attacker-influenced or uninitialized PTFF output as authoritative PTP time via ioctl can corrupt time-sync decisions for chrony/ptp4l and other consumers that steer system clocks from the physical-clock device.\nA:H - Executing PTFF without facility 28 or on unsupported configurations triggers an s390 program check in kernel context (illegal/specification exception) that ends in die(), causing a kernel oops/panic and total loss of host availability."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/ptp/ptp_s390.c"], "versions": [{"version": "2d7de7a3010d713fb89b7ba99e6fdc14475ad106", "lessThan": "b3efb4744abf493c9782eae713b861a80d9bbeca", "status": "affected", "versionType": "git"}, {"version": "2d7de7a3010d713fb89b7ba99e6fdc14475ad106", "lessThan": "545a7fdbc110c82933d448db2695abff07536f08", "status": "affected", "versionType": "git"}, {"version": "2d7de7a3010d713fb89b7ba99e6fdc14475ad106", "lessThan": "e78f1ac37afcb16cb6fef8a2c92591eab6558956", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/ptp/ptp_s390.c"], "versions": [{"version": "6.13", "status": "affected"}, {"version": "0", "lessThan": "6.13", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.42", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.6", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.18.42"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "7.1.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/b3efb4744abf493c9782eae713b861a80d9bbeca"}, {"url": "https://git.kernel.org/stable/c/545a7fdbc110c82933d448db2695abff07536f08"}, {"url": "https://git.kernel.org/stable/c/e78f1ac37afcb16cb6fef8a2c92591eab6558956"}], "title": "ptp: ptp_s390: Add missing facility check", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/ptp/ptp_s390.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "b3efb4744abf493c9782eae713b861a80d9bbeca", "status": "affected", "version": "2d7de7a3010d713fb89b7ba99e6fdc14475ad106", "versionType": "git"}, {"lessThan": "545a7fdbc110c82933d448db2695abff07536f08", "status": "affected", "version": "2d7de7a3010d713fb89b7ba99e6fdc14475ad106", "versionType": "git"}, {"lessThan": "e78f1ac37afcb16cb6fef8a2c92591eab6558956", "status": "affected", "version": "2d7de7a3010d713fb89b7ba99e6fdc14475ad106", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/ptp/ptp_s390.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.13"}, {"lessThan": "6.13", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.42", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nptp: ptp_s390: Add missing facility check\n\nOnly register the physical clock when facility 28 is installed\nand PTFF QAF returns that PTFF QPT is available."}], "id": "CVE-2026-68134", "lastModified": "2026-08-17T05:18:13.230", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.5, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-10T13:19:58.880", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/545a7fdbc110c82933d448db2695abff07536f08"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b3efb4744abf493c9782eae713b861a80d9bbeca"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e78f1ac37afcb16cb6fef8a2c92591eab6558956"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux kernel: ptp_s390 module registers physical clock without proper facility check", "id": "2513194", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513194"}, "csaw": false, "cvss3": {"cvss3_base_score": "2.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-280", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nptp: ptp_s390: Add missing facility check\nOnly register the physical clock when facility 28 is installed\nand PTFF QAF returns that PTFF QPT is available.", "A flaw was found in the `ptp_s390` module of the Linux kernel. This vulnerability allows the physical clock to be registered even when the necessary facility 28 is not installed or PTFF QPT is unavailable. This improper registration could lead to unexpected system behavior or a denial of service (DoS) condition."], "name": "CVE-2026-68134", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux_nvidia:", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux for NVIDIA 26"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-08-10T11:58:57Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-68134\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-68134\nhttps://git.kernel.org/stable/c/545a7fdbc110c82933d448db2695abff07536f08\nhttps://git.kernel.org/stable/c/b3efb4744abf493c9782eae713b861a80d9bbeca\nhttps://git.kernel.org/stable/c/e78f1ac37afcb16cb6fef8a2c92591eab6558956"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2d7de7a3010d713fb89b7ba99e6fdc14475ad106,b3efb4744abf493c9782eae713b861a80d9bbeca)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2d7de7a3010d713fb89b7ba99e6fdc14475ad106,545a7fdbc110c82933d448db2695abff07536f08)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2d7de7a3010d713fb89b7ba99e6fdc14475ad106,e78f1ac37afcb16cb6fef8a2c92591eab6558956)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.13"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.13)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.42,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.6,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-10T13:45:03.570250+00:00", "updated": "2026-08-14T02:30:17.845822+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}