In the Linux kernel, the following vulnerability has been resolved:

net: ravb: serialize PTP clock teardown

ravb ptp interrupt() can race with ravb ptp stop() and pass the clock to ptp clock event() while ptp clock unregister() is freeing it. This can lead to a use-after-free.

Use READ ONCE() and WRITE ONCE() for lockless access to the clock pointer. Atomically detach it with xchg() before disabling PTP interrupts, then synchronize all IRQs which can invoke ravb ptp interrupt() before unregistering the detached clock.

A handler which read the old pointer completes before the clock is unregistered, while later handlers read NULL and skip the event.