---
id: CVE-2026-98791
title: 'net/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereference'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereference

  During XSK TX queue teardown, outstanding descriptors are completed
  without a CQE. If one requested a TX t…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= ec706a860eba99bf934d59f74b5db90af44e882e <
    fce70b6bf9f3261e887419a4e7caa25b80fa9d55
  - >-
    Linux >= ec706a860eba99bf934d59f74b5db90af44e882e <
    f81d40e2eb69552334f510114f3e6edd0d43178b
  - >-
    Linux >= ec706a860eba99bf934d59f74b5db90af44e882e <
    63df0ef4c6e3105589e6bb2e758ce611b0ada86c
  - >-
    Linux >= ec706a860eba99bf934d59f74b5db90af44e882e <
    7b97273cbebe9dd4fddc457f0c4f2a124d0e3996
  - Linux 6.8
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:48:30.080Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98791'
references:
  - url: 'https://git.kernel.org/stable/c/fce70b6bf9f3261e887419a4e7caa25b80fa9d55'
  - url: 'https://git.kernel.org/stable/c/f81d40e2eb69552334f510114f3e6edd0d43178b'
  - url: 'https://git.kernel.org/stable/c/63df0ef4c6e3105589e6bb2e758ce611b0ada86c'
  - url: 'https://git.kernel.org/stable/c/7b97273cbebe9dd4fddc457f0c4f2a124d0e3996'
tags:
  - cve.org
ingestedAt: '2026-10-18T16:47:32.485Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereference

During XSK TX queue teardown, outstanding descriptors are completed
without a CQE. If one requested a TX timestamp, the completion path
passes that NULL CQE to mlx5e_xsk_fill_timestamp(), which dereferences
it.

Return zero when no CQE is available, indicating that teardown did not
produce a TX timestamp.

## Affected

- `Linux >= ec706a860eba99bf934d59f74b5db90af44e882e < fce70b6bf9f3261e887419a4e7caa25b80fa9d55`
- `Linux >= ec706a860eba99bf934d59f74b5db90af44e882e < f81d40e2eb69552334f510114f3e6edd0d43178b`
- `Linux >= ec706a860eba99bf934d59f74b5db90af44e882e < 63df0ef4c6e3105589e6bb2e758ce611b0ada86c`
- `Linux >= ec706a860eba99bf934d59f74b5db90af44e882e < 7b97273cbebe9dd4fddc457f0c4f2a124d0e3996`
- `Linux 6.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.