{"cve":"CVE-2026-98562","nvd":{"published":"2026-10-18T16:17:08.347","modified":"2026-10-19T10:19:12.813","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: libwx: fix races in Tx timestamp handling\n\nwx->ptp_tx_skb is shared between the Tx path, the PTP auxiliary\nworker and the timestamp cleanup paths. The\nWX_STATE_PTP_TX_IN_PROGRESS bit prevents multiple Tx paths from\nsubmitting timestamp requests, but does not serialize the worker\nagainst cleanup.\n\nAs a result, wx_ptp_clear_tx_timestamp() can free an skb after\nwx_ptp_tx_hwtstamp_work() has obtained its pointer. The worker may\nthen pass the freed skb to skb_tstamp_tx() and release the same\nreference again.\n\nThe cleanup path may also clear the in-progress bit while the worker\nis still processing the old skb. This allows the Tx path to publish a\nnew skb which the worker can subsequently overwrite with NULL,\nleaking its reference.\n\nAdd a dedicated spinlock to protect publication and consumption of\nthe Tx timestamp skb. Detach the skb and clear the in-progress bit\nwhile holding the lock, then deliver the timestamp and release the skb\nafter dropping it. Use the same locked cleanup in the quiesce path,\nbut keep the detach there free of register accesses: quiesce runs\nduring PCIe error recovery, where MMIO is not reliable, and it\ndeliberately did not touch the device before. The lock is taken with\ninterrupts disabled, because netpoll can call ndo_start_xmit() with\nhard interrupts already off.\n\nWhen handling a Tx DMA mapping failure, keep the transmit path\nreference until after comparing the skb under the lock. This prevents\nskb address reuse from making the error path mistake a newer timestamp\nrequest for the failed one.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/3173cba1170131816972ed2b6185cb970ba8b747","https://git.kernel.org/stable/c/e78b95cfd5df25d0c562aaef95d3c7fe6c7e0e66"],"products":[],"source":"nvd","synced_at":"2026-10-19T23:00:53.604569364+00:00"},"epss":{"cve":"CVE-2026-98562","score":0.00189,"percentile":0.08501,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}