CVE-2026-98562

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: libwx: fix races in Tx timestamp handling

wx->ptp_tx_skb is shared between the Tx path, the PTP auxiliary

worker and the timestamp cleanup paths. The

WX_STATE_PTP_TX_IN_PROGRESS bit prevents multiple Tx paths from

submitting timestamp requests, but does not serialize the worker

against cleanup.

As a result, wx_ptp_clear_tx_timestamp() can free an skb after

wx_ptp_tx_hwtstamp_work() has obtained its pointer. The worker may

then pass the freed skb to skb_tstamp_tx() and release the same

reference again.

The cleanup path may also clear the in-progress bit while the worker

is still processing the old skb. This allows the Tx path to publish a

new skb which the worker can subsequently overwrite with NULL,

leaking its reference.

Add a dedicated spinlock to protect publication and consumption of

the Tx timestamp skb. Detach the skb and clear the in-progress bit

while holding the lock, then deliver the timestamp and r

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References