Live › vulnerability › CVE-2026-98791
Go to dashboardDuring teardown of an AF_XDP transmit queue on Mellanox mlx5 NICs, outstanding descriptors that requested a TX timestamp are completed without a completion entry, and the kernel dereferences that missing entry. The sources describe a NULL pointer dereference in the kernel, which typically means a crash or denial of service rather than code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with the mlx5e driver (NVIDIA/Mellanox ConnectX NICs) that use AF_XDP sockets with TX timestamping enabled. Hosts without mlx5 hardware, or without AF_XDP zero-copy workloads, are unlikely to be affected.
No product ranges from the sources yet.
uname -r and compare it against the fixed kernel release in the NVD entrylsmod | grep mlx5_coress -xp or the application's own configurationEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereference
During XSK TX queue teardown, outstanding descriptors are completed without a CQE. If one requested a TX timestamp, the completion path passes that NULL CQE to mlx5e_xsk_fill_timestamp(), which dereferences it.
Return zero when no CQE is available, indicating that teardown did not produce a TX timestamp.
This page as .md · .json · in your agent: get_signal("CVE-2026-98791")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.