Live › vulnerability › CVE-2026-98562
Go to dashboardRaces in the libwx driver's Tx timestamp handling let the PTP worker and cleanup paths free the same packet buffer twice or leak it. The sources do not say what an attacker can do with the memory corruption.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems that run the libwx driver, which is used by certain Wangxun-based network adapters with PTP hardware timestamping enabled. Hosts without those adapters or without PTP timestamping on Tx are likely not exposed. unknown whether a default configuration loads the driver.
No product ranges from the sources yet.
lsmod | grep -i libwx or grep -i wx /proc/modulesuname -rEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
net: libwx: fix races in Tx timestamp handling
wx->ptp_tx_skb is shared between the Tx path, the PTP auxiliary worker and the timestamp cleanup paths. The WX_STATE_PTP_TX_IN_PROGRESS bit prevents multiple Tx paths from submitting timestamp requests, but does not serialize the worker against cleanup.
As a result, wx_ptp_clear_tx_timestamp() can free an skb after wx_ptp_tx_hwtstamp_work() has obtained its pointer. The worker may then pass the freed skb to skb_tstamp_tx() and release the same reference again.
The cleanup path may also clear the in-progress bit while the worker is still processing the old skb. This allows the Tx path to publish a new skb which the worker can subsequently overwrite with NULL, leaking its reference.
Add a dedicated spinlock to protect publication and consumption of the Tx timestamp skb. Detach the skb and clear the in-progress bit while holding the lock, then deliver the timestamp and release the skb after dropping it. Use the same locked cleanup in the quiesce path, but keep the detach there free of register accesses: quiesce runs during PCIe error recovery, where MMIO is not reliable, and it deliberately did not touch the device before. The lock is taken with interrupts disabled, because netpoll can call ndo_start_xmit() with hard interrupts already off.
When handling a Tx DMA mapping failure, keep the transmit path reference until after comparing the skb under the lock. This prevents skb address reuse from making the error path mistake a newer timestamp request for the failed one.
This page as .md · .json · in your agent: get_signal("CVE-2026-98562")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.