CVE-2026-90100: ptp: netc: fix period truncation and potential divide-by-zero in PEROUT

CVE-2026-90100: ptp: netc: fix period truncation and potential divide-by-zero in PEROUT

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ptp: netc: fix period truncation and potential divide-by-zero in PEROUT

The max_period bound in net_timer_enable_perout() was computed as:

  max_period = (u64)NETC_TMR_DEFAULT_FIPER + integral_period;

which exceeds U32_MAX when integral_period > 0 (e.g. 0x100000002 for
the default 333333333 Hz clock). A period_ns that passes this check but
exceeds U32_MAX is then silently truncated when stored into the u32
struct netc_pp::period field.

A truncated value of zero can reach netc_timer_set_perout_alarm(), where
the local u32 period variable would also be 0, causing a divide-by-zero
in roundup_u64(delta, period) whenever the stime < min_time branch is
taken (which always happens for a start time of {0, 0}).

Additionally, netc_timer_enable_periodic_pulse() and
netc_timer_enable_fiper() both compute:

  fiper = pp->period - integral_period;

A zero pp->period results in an unsigned wraparound to 0xFFFFFFFD,
mis-programming the FIPER hardware register.

Fix all three issues by capping max_period at NETC_TMR_DEFAULT_FIPER
(0xFFFFFFFF). This ensures that any period_ns passing the range check
fits in a u32 without truncation, so the stored value is always valid
and non-zero. The accepted range is reduced by integral_period ns
(typically only a few nanoseconds), which is negligible in practice.

The Linux kernel CVE team has assigned CVE-2026-90100 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.18 with commit 671e266835b8a87d6cc2c6db962de23783405dd8 and fixed in 6.18.52 with commit 51fe3fe0ffec033bd831c71d9bee3dee827e491c
	Issue introduced in 6.18 with commit 671e266835b8a87d6cc2c6db962de23783405dd8 and fixed in 7.2.6 with commit 08988d1941e180f0ad30d91233cb64f3418ba23c
	Issue introduced in 6.18 with commit 671e266835b8a87d6cc2c6db962de23783405dd8 and fixed in 7.3-rc1 with commit 777dbc9914b2f003f1d44af80c7a4a395c5961b2

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-90100
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/ptp/ptp_netc.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/51fe3fe0ffec033bd831c71d9bee3dee827e491c
	https://git.kernel.org/stable/c/08988d1941e180f0ad30d91233cb64f3418ba23c
	https://git.kernel.org/stable/c/777dbc9914b2f003f1d44af80c7a4a395c5961b2