A high-severity memory management flaw in the Linux kernel allows local authenticated attackers to corrupt host-controlled timekeeping data, leading to potential system instability or privilege escalation.

The vmclock_miscdev_mmap function fails to clear the VM_MAYWRITE flag when creating read-only mappings, which allows a local authenticated user to use mprotect to elevate the mapping to writable. This permits the guest to overwrite host-managed timekeeping structures defined by the vmclock ABI.

The ability to manipulate timekeeping data represents a critical security risk for virtualized environments. Successful exploitation allows a local attacker to corrupt host-level timekeeping, which can lead to the subversion of security mechanisms that rely on accurate system time, potential denial of service, or cross-boundary data integrity issues. With a CVSS score of 8.8, this vulnerability is classified as High and requires immediate attention for any system utilizing the vmclock ABI.

Immediate Action: Update the Linux kernel to versions 6.18.47, 7.1.11, 7.2.1, or later, which contain the necessary fix to clear the VM_MAYWRITE flag.

Proactive Monitoring: Monitor system logs for unusual mprotect calls or processes attempting to interact with the vmclock device in ways that deviate from standard operational patterns.

Compensating Controls: Restrict access to the vmclock device node for non-privileged users and ensure that virtual machine isolation policies are strictly enforced to limit the potential impact of a guest-side compromise.

Public Exploit Available: Unknown

Given the potential for guest-to-host impact, organizations running virtualized Linux workloads should prioritize patching the kernel across all affected nodes. Applying the vendor-provided updates is the only definitive way to prevent the unauthorized modification of the vmclock ABI page. Failure to patch may expose host systems to integrity risks originating from compromised guest environments.