---
id: "CVE-2026-98562"
kind: "vulnerability"
aliases: ["CVE-2026-98562"]
title: "Linux kernel: libwx Tx timestamp races can free an skb twice"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["linux-kernel", "package", "ptp", "self-hosted", "wangxun-nic"]
not_affected_if: ["no-libwx-hardware"]
published_at: "2026-10-18T16:17:08+00:00"
first_seen_at: "2026-10-23T21:57:15+00:00"
updated_at: "2026-10-25T05:23:21+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98562", "first_seen_at": "2026-10-23T21:57:15+00:00"}]
---

# Linux kernel: libwx Tx timestamp races can free an skb twice

Races in the libwx driver's Tx timestamp handling let the PTP worker and cleanup paths free the same packet buffer twice or leak it. The sources do not say what an attacker can do with the memory corruption.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the kernel includes the libwx driver: `lsmod | grep -i libwx` or `grep -i wx /proc/modules`
- Compare the running kernel to the fixed release in the NVD entry: `uname -r`
- unknown: the sources do not list affected kernel versions

## Fix

- Update the Linux kernel to a release that includes the upstream commit fixing libwx Tx timestamp races
- unknown: the sources do not name the fixed kernel version

## Timeline

- 2026-10-23T21:57:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98562

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

net: libwx: fix races in Tx timestamp handling

wx->ptp_tx_skb is shared between the Tx path, the PTP auxiliary
worker and the timestamp cleanup paths. The
WX_STATE_PTP_TX_IN_PROGRESS bit prevents multiple Tx paths from
submitting timestamp requests, but does not serialize the worker
against cleanup.

As a result, wx_ptp_clear_tx_timestamp() can free an skb after
wx_ptp_tx_hwtstamp_work() has obtained its pointer. The worker may
then pass the freed skb to skb_tstamp_tx() and release the same
reference again.

The cleanup path may also clear the in-progress bit while the worker
is still processing the old skb. This allows the Tx path to publish a
new skb which the worker can subsequently overwrite with NULL,
leaking its reference.

Add a dedicated spinlock to protect publication and consumption of
the Tx timestamp skb. Detach the skb and clear the in-progress bit
while holding the lock, then deliver the timestamp and release the skb
after dropping it. Use the same locked cleanup in the quiesce path,
but keep the detach there free of register accesses: quiesce runs
during PCIe error recovery, where MMIO is not reliable, and it
deliberately did not touch the device before. The lock is taken with
interrupts disabled, because netpoll can call ndo_start_xmit() with
hard interrupts already off.

When handling a Tx DMA mapping failure, keep the transmit path
reference until after comparing the skb under the lock. This prevents
skb address reuse from making the error path mistake a newer timestamp
request for the failed one.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_