{"id":"CVE-2026-98562","title":"net: libwx: fix races in Tx timestamp handling","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: libwx: fix races in Tx timestamp handling\n\nwx->ptp_tx_skb is shared between the Tx path, the PTP auxiliary\nworker and the timestamp cleanup paths. The\nWX_STATE_PTP…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 06e75161b9d4833518a7c266310a0635eab50616 < e78b95cfd5df25d0c562aaef95d3c7fe6c7e0e66","Linux >= 06e75161b9d4833518a7c266310a0635eab50616 < 3173cba1170131816972ed2b6185cb970ba8b747","Linux 6.15"],"published":"2026-10-18","updated":"2026-10-18","sourceUpdated":"2026-10-18T15:18:29.310Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98562","references":[{"url":"https://git.kernel.org/stable/c/e78b95cfd5df25d0c562aaef95d3c7fe6c7e0e66"},{"url":"https://git.kernel.org/stable/c/3173cba1170131816972ed2b6185cb970ba8b747"}],"tags":["cve.org"],"ingestedAt":"2026-10-18T15:45:12.259Z","slug":"CVE-2026-98562","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: libwx: fix races in Tx timestamp handling\n\nwx->ptp_tx_skb is shared between the Tx path, the PTP auxiliary\nworker and the timestamp cleanup paths. The\nWX_STATE_PTP_TX_IN_PROGRESS bit prevents multiple Tx paths from\nsubmitting timestamp requests, but does not serialize the worker\nagainst cleanup.\n\nAs a result, wx_ptp_clear_tx_timestamp() can free an skb after\nwx_ptp_tx_hwtstamp_work() has obtained its pointer. The worker may\nthen pass the freed skb to skb_tstamp_tx() and release the same\nreference again.\n\nThe cleanup path may also clear the in-progress bit while the worker\nis still processing the old skb. This allows the Tx path to publish a\nnew skb which the worker can subsequently overwrite with NULL,\nleaking its reference.\n\nAdd a dedicated spinlock to protect publication and consumption of\nthe Tx timestamp skb. Detach the skb and clear the in-progress bit\nwhile holding the lock, then deliver the timestamp and release the skb\nafter dropping it. Use the same locked cleanup in the quiesce path,\nbut keep the detach there free of register accesses: quiesce runs\nduring PCIe error recovery, where MMIO is not reliable, and it\ndeliberately did not touch the device before. The lock is taken with\ninterrupts disabled, because netpoll can call ndo_start_xmit() with\nhard interrupts already off.\n\nWhen handling a Tx DMA mapping failure, keep the transmit path\nreference until after comparing the skb under the lock. This prevents\nskb address reuse from making the error path mistake a newer timestamp\nrequest for the failed one.\n\n## Affected\n\n- `Linux >= 06e75161b9d4833518a7c266310a0635eab50616 < e78b95cfd5df25d0c562aaef95d3c7fe6c7e0e66`\n- `Linux >= 06e75161b9d4833518a7c266310a0635eab50616 < 3173cba1170131816972ed2b6185cb970ba8b747`\n- `Linux 6.15`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}