CVE-2026-98562
Received Received - Intake

Race Condition in Linux Kernel Net: libwx Tx Timestamp Handling

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: libwx: fix races in Tx timestamp handling wx->ptp_tx_skb is shared between the Tx path, the PTP auxiliary worker and the timestamp cleanup paths. The WX_STATE_PTP_TX_IN_PROGRESS bit prevents multiple Tx paths from submitting timestamp requests, but does not serialize the worker against cleanup. As a result, wx_ptp_clear_tx_timestamp() can free an skb after wx_ptp_tx_hwtstamp_work() has obtained its pointer. The worker may then pass the freed skb to skb_tstamp_tx() and release the same reference again. The cleanup path may also clear the in-progress bit while the worker is still processing the old skb. This allows the Tx path to publish a new skb which the worker can subsequently overwrite with NULL, leaking its reference. Add a dedicated spinlock to protect publication and consumption of the Tx timestamp skb. Detach the skb and clear the in-progress bit while holding the lock, then deliver the timestamp and release the skb after dropping it. Use the same locked cleanup in the quiesce path, but keep the detach there free of register accesses: quiesce runs during PCIe error recovery, where MMIO is not reliable, and it deliberately did not touch the device before. The lock is taken with interrupts disabled, because netpoll can call ndo_start_xmit() with hard interrupts already off. When handling a Tx DMA mapping failure, keep the transmit path reference until after comparing the skb under the lock. This prevents skb address reuse from making the error path mistake a newer timestamp request for the failed one.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98562
EUVD
EUVD-2026-103607

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
Linux Linux 06e75161b9d4833518a7c266310a0635eab50616
Linux Linux 06e75161b9d4833518a7c266310a0635eab50616
Linux Linux 6.15

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a race condition in the Tx timestamp handling for the net: libwx driver. The issue occurs because wx->ptp_tx_skb is shared between multiple paths (Tx, PTP worker, and cleanup), leading to potential use-after-free or reference leaks when the skb is freed prematurely or overwritten incorrectly.

Detection Guidance

This vulnerability is specific to the Linux kernel's net: libwx driver and involves race conditions in timestamp handling. Detection requires checking kernel logs for related errors or kernel crashes during network operations. Commands like dmesg | grep wx or journalctl -k | grep wx may help identify issues. Ensure your kernel version is updated to a patched release.

Impact Analysis

This vulnerability could cause system instability, crashes, or data corruption due to improper memory handling. It may also lead to incorrect timestamp reporting in network operations, affecting time-sensitive applications or logging.

Mitigation Strategies

Immediately update the Linux kernel to the latest stable version that includes the fix for this vulnerability. If updating is not immediately possible, consider disabling the affected driver module (wx) if not critical to operations. Monitor kernel logs for any signs of exploitation or instability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98562. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart