Linux Kernel Vulnerability Affecting Virtual Clock Management

CVE-2026-80724

What is CVE-2026-80724?

A vulnerability in the Linux kernel's virtual clock management allows userspace to exploit read-only memory mappings. By mapping the shared vmclock ABI page as read-only, an attacker could subsequently elevate it to writable using mprotect(). This alteration poses a risk as it may corrupt critical host-written timekeeping data, including the sequence counter and UTC time. The issue arises since the function responsible for memory mapping retains a VM_MAYWRITE flag for read-only mappings, enabling the potential for data corruption. This vulnerability has been addressed to ensure that read-only paths correctly clear the flag, preventing such escalation.

References