CVE-2026-98795
Received Received - Intake

NULL Pointer Dereference in Linux Kernel SPARX5 PTP

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: sparx5: skip ptp deinit if init was skipped sparx5_ptp_init() returns early on the base lan969x variants because they do not have the SPX5_FEATURE_PTP flag. It also returns early when no "ptp" interrupt is described. Unbinding the driver then causes a NULL pointer dereference when cleaning up uninitialized tx_skbs queues: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 Call trace: skb_queue_purge_reason+0x68/0x120 (P) sparx5_ptp_deinit+0x64/0xc0 mchp_sparx5_remove+0x38/0x70 platform_remove+0x20/0x30 device_remove+0x4c/0x80 Before per-port tx_skbs were added, a NULL dereference would have happened when calling ptp_clock_unregister() on the never-registered PTP clocks. Fix by returning early in sparx5_ptp_deinit() if PTP is not used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98795
EUVD
EUVD-2026-103880

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
Linux Linux 0933bd04047c3b96ba49545a8f91e7e6f8f666ff
Linux Linux 0933bd04047c3b96ba49545a8f91e7e6f8f666ff
Linux Linux 0933bd04047c3b96ba49545a8f91e7e6f8f666ff
Linux Linux 5.18

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Linux kernel's sparx5 network driver. It occurs when the PTP (Precision Time Protocol) initialization is skipped due to missing hardware support or interrupt description. Later, when the driver is unloaded, it attempts to clean up uninitialized resources, causing a NULL pointer dereference and kernel crash.

Detection Guidance

This vulnerability affects the Linux kernel's sparx5 network driver, specifically when PTP (Precision Time Protocol) initialization is skipped but deinitialization is attempted. Detection involves checking for kernel logs indicating NULL pointer dereferences in sparx5_ptp_deinit or mchp_sparx5_remove functions. Monitor system logs for errors like 'Unable to handle kernel NULL pointer dereference' or crashes during driver unbind operations.

Impact Analysis

If you use a system with a Sparx5 network chip, this vulnerability could cause the kernel to crash when unloading the driver, leading to a denial of service. Systems relying on network connectivity or real-time operations could be disrupted.

Mitigation Strategies

Apply the kernel patch that adds an early return in sparx5_ptp_deinit() if PTP is not initialized. Avoid unbinding the sparx5 driver if your system uses base lan969x variants or lacks a PTP interrupt. Update to a fixed kernel version where this issue is resolved.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98795. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart