Description
In the Linux kernel, the following vulnerability has been resolved:

net: libwx: fix races in Tx timestamp handling

wx->ptp_tx_skb is shared between the Tx path, the PTP auxiliary
worker and the timestamp cleanup paths. The
WX_STATE_PTP_TX_IN_PROGRESS bit prevents multiple Tx paths from
submitting timestamp requests, but does not serialize the worker
against cleanup.

As a result, wx_ptp_clear_tx_timestamp() can free an skb after
wx_ptp_tx_hwtstamp_work() has obtained its pointer. The worker may
then pass the freed skb to skb_tstamp_tx() and release the same
reference again.

The cleanup path may also clear the in-progress bit while the worker
is still processing the old skb. This allows the Tx path to publish a
new skb which the worker can subsequently overwrite with NULL,
leaking its reference.

Add a dedicated spinlock to protect publication and consumption of
the Tx timestamp skb. Detach the skb and clear the in-progress bit
while holding the lock, then deliver the timestamp and release the skb
after dropping it. Use the same locked cleanup in the quiesce path,
but keep the detach there free of register accesses: quiesce runs
during PCIe error recovery, where MMIO is not reliable, and it
deliberately did not touch the device before. The lock is taken with
interrupts disabled, because netpoll can call ndo_start_xmit() with
hard interrupts already off.

When handling a Tx DMA mapping failure, keep the transmit path
reference until after comparing the skb under the lock. This prevents
skb address reuse from making the error path mistake a newer timestamp
request for the failed one.
Published: 2026-10-18
Score: 4.7 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Use-After-Free (double free) of network socket buffer
Action: Immediate Patch
AI Analysis

Impact

The flaw arises from a race condition in which the Tx timestamp buffer is shared between the transmission path and the PTP worker. The worker may act on a buffer that has already been freed, leading to a double free or use‑after‑free situation. This kernel bug can trigger a crash or data corruption, potentially allowing a local attacker to destabilize the system or compromise network integrity.

Affected Systems

The vulnerability affects the Linux kernel, but specific distribution or kernel release details are not provided in the data, so the scope cannot be precisely defined beyond the kernel code involved.

Risk and Exploitability

The vulnerability is a race condition that can lead to kernel memory corruption. It has a CVSS score of 4.7, indicating moderate severity. The EPSS score is less than 1%, suggesting a low probability of exploitation, and it is not listed in the CISA KEV catalog. While no publicly reported exploits exist, the flaw could be used by a local attacker to trigger a kernel panic or corrupt data, potentially destabilizing the system or affecting network traffic.

Generated by OpenCVE AI on October 22, 2026 at 22:15 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the kernel patch that introduces a dedicated spinlock to serialize Tx timestamp handling.
  • Upgrade to a kernel version newer than the fix in the source tree, ensuring the spinlock protection is in place.
  • If a kernel update is not immediately possible, disable PTP functionality that relies on libwx until the fix can be applied.

Generated by OpenCVE AI on October 22, 2026 at 22:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 21:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-362
CWE-416

Tue, 20 Oct 2026 12:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-366
References
Metrics threat_severity

None

 cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Mon, 19 Oct 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-362
CWE-416

Sun, 18 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: net: libwx: fix races in Tx timestamp handling wx->ptp_tx_skb is shared between the Tx path, the PTP auxiliary worker and the timestamp cleanup paths. The WX_STATE_PTP_TX_IN_PROGRESS bit prevents multiple Tx paths from submitting timestamp requests, but does not serialize the worker against cleanup. As a result, wx_ptp_clear_tx_timestamp() can free an skb after wx_ptp_tx_hwtstamp_work() has obtained its pointer. The worker may then pass the freed skb to skb_tstamp_tx() and release the same reference again. The cleanup path may also clear the in-progress bit while the worker is still processing the old skb. This allows the Tx path to publish a new skb which the worker can subsequently overwrite with NULL, leaking its reference. Add a dedicated spinlock to protect publication and consumption of the Tx timestamp skb. Detach the skb and clear the in-progress bit while holding the lock, then deliver the timestamp and release the skb after dropping it. Use the same locked cleanup in the quiesce path, but keep the detach there free of register accesses: quiesce runs during PCIe error recovery, where MMIO is not reliable, and it deliberately did not touch the device before. The lock is taken with interrupts disabled, because netpoll can call ndo_start_xmit() with hard interrupts already off. When handling a Tx DMA mapping failure, keep the transmit path reference until after comparing the skb under the lock. This prevents skb address reuse from making the error path mistake a newer timestamp request for the failed one.
Title net: libwx: fix races in Tx timestamp handling
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-19T09:21:46.397Z

Reserved: 2026-09-25T10:25:14.357Z

Link: CVE-2026-98562

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-18T16:17:08.347

Modified: 2026-10-19T10:19:12.813

Link: CVE-2026-98562

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-18T00:00:00Z

Links: CVE-2026-98562 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T22:30:13Z

Weaknesses
  • CWE-366

    Race Condition within a Thread