{"id":"CVE-2026-98562","kind":"vulnerability","aliases":["CVE-2026-98562"],"related":[],"title":"Linux kernel: libwx Tx timestamp races can free an skb twice","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: libwx: fix races in Tx timestamp handling\n\nwx->ptp_tx_skb is shared between the Tx path, the PTP auxiliary\nworker and the timestamp cleanup paths. The\nWX_STATE_PTP_TX_IN_PROGRESS bit prevents multiple Tx paths from\nsubmitting timestamp requests, but does not serialize the worker\nagainst cleanup.\n\nAs a result, wx_ptp_clear_tx_timestamp() can free an skb after\nwx_ptp_tx_hwtstamp_work() has obtained its pointer. The worker may\nthen pass the freed skb to skb_tstamp_tx() and release the same\nreference again.\n\nThe cleanup path may also clear the in-progress bit while the worker\nis still processing the old skb. This allows the Tx path to publish a\nnew skb which the worker can subsequently overwrite with NULL,\nleaking its reference.\n\nAdd a dedicated spinlock to protect publication and consumption of\nthe Tx timestamp skb. Detach the skb and clear the in-progress bit\nwhile holding the lock, then deliver the timestamp and release the skb\nafter dropping it. Use the same locked cleanup in the quiesce path,\nbut keep the detach there free of register accesses: quiesce runs\nduring PCIe error recovery, where MMIO is not reliable, and it\ndeliberately did not touch the device before. The lock is taken with\ninterrupts disabled, because netpoll can call ndo_start_xmit() with\nhard interrupts already off.\n\nWhen handling a Tx DMA mapping failure, keep the transmit path\nreference until after comparing the skb under the lock. This prevents\nskb address reuse from making the error path mistake a newer timestamp\nrequest for the failed one.","summary":"Races in the libwx driver's Tx timestamp handling let the PTP worker and cleanup paths free the same packet buffer twice or leak it. The sources do not say what an attacker can do with the memory corruption.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux-kernel","package","ptp","self-hosted","wangxun-nic"],"not_affected_if":["no-libwx-hardware"],"how_to_check":"- Check whether the kernel includes the libwx driver: `lsmod | grep -i libwx` or `grep -i wx /proc/modules`\n- Compare the running kernel to the fixed release in the NVD entry: `uname -r`\n- unknown: the sources do not list affected kernel versions","fix":"- Update the Linux kernel to a release that includes the upstream commit fixing libwx Tx timestamp races\n- unknown: the sources do not name the fixed kernel version","status":"open","published_at":"2026-10-18T16:17:08+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:23:21+00:00","updated_at":"2026-10-25T05:23:21+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T05:23:21Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit fixing libwx Tx timestamp races\n- unknown: the sources do not name the fixed kernel version","reach":"local","title":"Linux kernel: libwx Tx timestamp races can free an skb twice","impact":"medium","summary":"Races in the libwx driver's Tx timestamp handling let the PTP worker and cleanup paths free the same packet buffer twice or leak it. The sources do not say what an attacker can do with the memory corruption.","category":"package","nicknames":[],"who_cares":["linux-kernel","wangxun-nic","ptp","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Kernel memory double-freed or leaked, possibly crashing the host","analyst_note":"Check the NVD entry and the upstream kernel commit for affected version ranges and whether the race is reachable without privileges.","how_to_check":"- Check whether the kernel includes the libwx driver: `lsmod | grep -i libwx` or `grep -i wx /proc/modules`\n- Compare the running kernel to the fixed release in the NVD entry: `uname -r`\n- unknown: the sources do not list affected kernel versions","needs_analyst":true,"not_affected_if":["no-libwx-hardware"],"who_is_affected":"Systems that run the libwx driver, which is used by certain Wangxun-based network adapters with PTP hardware timestamping enabled. Hosts without those adapters or without PTP timestamping on Tx are likely not exposed. unknown whether a default configuration loads the driver.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000678,"input_tokens":3809,"output_tokens":595,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98562':14A,17A 'access':266C 'add':210C 'address':329C 'allow':190C 'alreadi':304C 'also':173C 'attack':61B 'auxiliari':98C 'bit':112C,179C,233C 'buffer':49B 'call':297C 'cleanup':43B,103C,128C,170C,253C 'clear':134C,174C,228C 'compar':320C 'consumpt':218C 'corrupt':67B 'cve':12A,15A 'dedic':212C 'deliber':280C 'deliv':239C 'detach':224C,261C 'devic':285C 'disabl':293C 'dma':310C 'driver':33B 'drop':247C 'error':271C,334C 'fail':343C 'failur':312C 'fix':80C 'follow':73C 'free':8A,45B,138C,263C 'freed':157C 'handl':37B,85C,307C 'hard':302C 'hold':235C 'host':25B 'hwtstamp':145C 'in-progress':176C,230C 'interrupt':292C,303C 'keep':259C,313C 'kernel':2A,20B,71C 'leak':52B,207C 'let':38B 'libwx':3A,32B,79C 'linux':1A,19B,70C 'linux-kernel':18B 'lock':237C,252C,288C,325C 'make':332C 'map':311C 'may':153C,172C 'memori':66B 'mistak':336C 'mmio':274C 'multipl':114C 'ndo':298C 'net':78C 'netpol':295C 'new':197C 'newer':338C 'nic':28B 'null':206C 'obtain':148C 'old':187C 'one':344C 'overwrit':204C 'packag':21B 'packet':48B 'pass':155C 'path':44B,95C,104C,116C,171C,193C,257C,316C,335C 'pcie':270C 'pointer':150C 'prevent':113C,327C 'process':185C 'progress':111C,178C,232C 'protect':215C 'ptp':22B,40B,87C,97C,108C,133C,143C 'public':216C 'publish':195C 'quiesc':256C,267C 'race':6A,29B,81C 'recoveri':272C 'refer':167C,209C,317C 'regist':265C 'releas':164C,243C 'reliabl':277C 'request':120C,340C 'resolv':77C 'result':131C 'reus':330C 'run':268C 'say':58B 'self':24B 'self-host':23B 'serial':124C 'share':91C 'skb':10A,89C,140C,158C,160C,188C,198C,223C,226C,245C,322C,328C 'sourc':55B 'spinlock':213C 'start':299C 'state':107C 'still':184C 'submit':118C 'subsequ':203C 'taken':290C 'timestamp':5A,36B,84C,102C,119C,136C,222C,241C,339C 'touch':283C 'transmit':315C 'tstamp':161C 'twice':11A,50B 'tx':4A,35B,83C,88C,94C,109C,115C,135C,144C,162C,192C,221C,309C 'use':249C 'vulner':74C 'wangxun':27B 'wangxun-n':26B 'work':146C 'worker':41B,99C,126C,152C,182C,201C 'wx':86C,106C,132C,142C 'xmit':300C","nicknames":[],"mitigations":[],"who_affected":"Systems that run the libwx driver, which is used by certain Wangxun-based network adapters with PTP hardware timestamping enabled. Hosts without those adapters or without PTP timestamping on Tx are likely not exposed. unknown whether a default configuration loads the driver.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:08+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98562","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98562","severity":null,"published_at":"2026-10-18T16:17:08+00:00","modified_at":"2026-10-19T10:19:12+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}