SECUFOCUSNOW
Home›CVE index›CVE-2026-31396
Review reviewHigh

CVE-2026-31396

Linux Linux, SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP

In the Linux kernel, the following vulnerability has been resolved: net: macb: fix use-after-free access to PTP clock PTP clock is registered on every opening of the interface and destroyed on every closing. However it may be accessed via get_ts_info ethtool call which is possible while the interface is just present in the kernel. BUG: KASAN: use-after-free in ptp_clock_index+0x47/0x50 drivers/ptp/ptp_clock.c:426 Read of size 4 at addr ffff8880194345cc by task syz.0.6/948 CPU: 1 PID: 948 Comm: syz.0.6 Not tainted 6.1.164+ #109 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.1...

CVSS
7.8
EPSS
0.12%
2.37% percentile
CISA KEV
Not listed
Published
2026.04.04
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.12%
Technical severityCVSS 7.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: net: macb: fix use-after-free access to PTP clock PTP clock is registered on every opening of the interface and destroyed on every closing. However it may be accessed via get_ts_info ethtool call which is possible while the interface is just present in the kernel. BUG: KASAN: use-after-free in ptp_clock_index+0x47/0x50 drivers/ptp/ptp_clock.c:426 Read of size 4 at addr ffff8880194345cc by task syz.0.6/948 CPU: 1 PID: 948 Comm: syz.0.6 Not tainted 6.1.164+ #109 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.1...

Affected product and versions

Product
Linux Linux, SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
Affected versions
>= c2594d804d5c8033861d44840673d852d98508c1 < 8820ffe0975fd2efbe50453e9179c8e1c33a13d3, >= c2594d804d5c8033861d44840673d852d98508c1 < 6b757f345eeea87ed5d8afd6de35b927a1a57a2f, >= c2594d804d5c8033861d44840673d852d98508c1 < 341d01087f821aa0f165fb1ffc8bfe4e50776da7, >= c2594d804d5c8033861d44840673d852d98508c1 < 5653af416a48f6c18f9626ae9df96f814f45ff34, >= c2594d804d5c8033861d44840673d852d98508c1 < 0bb848d8c64938024e45780f8032f1f67d3a3607, >= c2594d804d5c8033861d44840673d852d98508c1 < 1f4714065b2bcbb0a4013fd355b84b848e6cc345, >= c2594d804d5c8033861d44840673d852d98508c1 < eb652535e9ec795ef5c1078f7578eaaed755268b, >= c2594d804d5c8033861d44840673d852d98508c1 < 8da13e6d63c1a97f7302d342c89c4a56a55c7015, >= 4.11, >= V3.1.6, >= V3.1.5, >= 4.11 < 5.10.253, >= 5.11 < 5.15.203, >= 5.16 < 6.1.167, >= 6.2 < 6.6.130, >= 6.7 < 6.12.78, >= 6.13 < 6.18.20, >= 6.19 < 6.19.10, 7.0
Fixed versions
5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.20, 6.19.10

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux Linux, SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-416