{"id":"CVE-2026-98791","kind":"vulnerability","aliases":["CVE-2026-98791"],"related":[],"title":"Linux kernel: mlx5 AF_XDP teardown can crash the system via NULL dereference","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereference\n\nDuring XSK TX queue teardown, outstanding descriptors are completed\nwithout a CQE. If one requested a TX timestamp, the completion path\npasses that NULL CQE to mlx5e_xsk_fill_timestamp(), which dereferences\nit.\n\nReturn zero when no CQE is available, indicating that teardown did not\nproduce a TX timestamp.","summary":"During teardown of an AF_XDP transmit queue on Mellanox mlx5 NICs, outstanding descriptors that requested a TX timestamp are completed without a completion entry, and the kernel dereferences that missing entry. The sources describe a NULL pointer dereference in the kernel, which typically means a crash or denial of service rather than code execution.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["af_xdp","infrastructure","kernel","linux","mellanox","mlx5","nvidia"],"not_affected_if":["no-af_xdp-sockets","no-mlx5-hardware","no-tx-timestamping"],"how_to_check":"- Check the running kernel version with `uname -r` and compare it against the fixed kernel release in the NVD entry\n- Check whether the mlx5 driver is loaded with `lsmod | grep mlx5_core`\n- Check whether AF_XDP sockets are in use on mlx5 interfaces, for example with `ss -xp` or the application's own configuration","fix":"- Update the Linux kernel to a release that includes the upstream fix for net/mlx5e AF_XDP TX timestamp teardown\n- Version numbers are unknown from the sources; check the kernel stable branch referenced in the NVD entry","status":"open","published_at":"2026-10-18T16:17:33+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:15:15+00:00","updated_at":"2026-10-25T05:15:15+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:15:15Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream fix for net/mlx5e AF_XDP TX timestamp teardown\n- Version numbers are unknown from the sources; check the kernel stable branch referenced in the NVD entry","reach":"local","title":"Linux kernel: mlx5 AF_XDP teardown can crash the system via NULL dereference","impact":"low","summary":"During teardown of an AF_XDP transmit queue on Mellanox mlx5 NICs, outstanding descriptors that requested a TX timestamp are completed without a completion entry, and the kernel dereferences that missing entry. The sources describe a NULL pointer dereference in the kernel, which typically means a crash or denial of service rather than code execution.","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","mlx5","mellanox","nvidia","af_xdp"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Kernel NULL dereference crashes the host, causing denial of service","analyst_note":"Confirm the fixed kernel versions and the upstream commit from the NVD entry and kernel stable mailing list; severity and trigger conditions are not stated in the sources.","how_to_check":"- Check the running kernel version with `uname -r` and compare it against the fixed kernel release in the NVD entry\n- Check whether the mlx5 driver is loaded with `lsmod | grep mlx5_core`\n- Check whether AF_XDP sockets are in use on mlx5 interfaces, for example with `ss -xp` or the application's own configuration","needs_analyst":true,"not_affected_if":["no-mlx5-hardware","no-af_xdp-sockets","no-tx-timestamping"],"who_is_affected":"Systems running a Linux kernel with the mlx5e driver (NVIDIA/Mellanox ConnectX NICs) that use AF_XDP sockets with TX timestamping enabled. Hosts without mlx5 hardware, or without AF_XDP zero-copy workloads, are unlikely to be affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000717,"input_tokens":3397,"output_tokens":754,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-98791':16A,19A 'af':4A,20B,32B,95C 'avail':141C 'code':81B 'complet':48B,51B,110C,121C 'cqe':113C,126C,139C 'crash':8A,74B 'cve':14A,17A 'denial':76B 'derefer':13A,56B,66B,101C,133C 'describ':62B 'descriptor':41B,108C 'entri':52B,59B 'execut':82B 'fill':130C 'fix':94C 'follow':88C 'indic':142C 'infrastructur':22B 'kernel':2A,23B,55B,69B,86C 'linux':1A,24B,85C 'mean':72B 'mellanox':25B,37B 'miss':58B 'mlx5':3A,26B,38B 'mlx5e':128C 'net/mlx5e':93C 'nic':39B 'null':12A,64B,100C,125C 'nvidia':27B 'one':115C 'outstand':40B,107C 'pass':123C 'path':122C 'pointer':65B 'produc':147C 'queue':35B,105C 'rather':79B 'request':43B,116C 'resolv':92C 'return':135C 'servic':78B 'sourc':61B 'system':10A 'teardown':6A,29B,99C,106C,144C 'timestamp':46B,98C,119C,131C,150C 'transmit':34B 'tx':45B,97C,104C,118C,149C 'typic':71B 'via':11A 'vulner':89C 'without':49B,111C 'xdp':5A,21B,33B,96C 'xsk':103C,129C 'zero':136C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the mlx5e driver (NVIDIA/Mellanox ConnectX NICs) that use AF_XDP sockets with TX timestamping enabled. Hosts without mlx5 hardware, or without AF_XDP zero-copy workloads, are unlikely to be affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:33+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98791","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98791","severity":null,"published_at":"2026-10-18T16:17:33+00:00","modified_at":"2026-10-19T10:19:43+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}