Live › vulnerability › CVE-2026-98795
Go to dashboardIn the Linux kernel's Microchip sparx5 network driver, unbinding the driver on lan969x variants without PTP support dereferences an uninitialized queue and crashes the kernel. The sources describe a local kernel NULL pointer dereference during driver removal and do not describe a remote attacker path.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running Linux kernels with the Microchip sparx5 network driver on lan969x base variants, where the driver is unbound or removed. The sources do not say which kernel versions are affected or which fixed versions exist, so check the kernel package changelog for CVE-2026-98795.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
net: sparx5: skip ptp deinit if init was skipped
sparx5_ptp_init() returns early on the base lan969x variants because they do not have the SPX5_FEATURE_PTP flag. It also returns early when no "ptp" interrupt is described. Unbinding the driver then causes a NULL pointer dereference when cleaning up uninitialized tx_skbs queues:
Unable to handle kernel NULL pointer dereference at virtual address
0000000000000008
Call trace:
skb_queue_purge_reason+0x68/0x120 (P)
sparx5_ptp_deinit+0x64/0xc0
mchp_sparx5_remove+0x38/0x70
platform_remove+0x20/0x30
device_remove+0x4c/0x80
Before per-port tx_skbs were added, a NULL dereference would have happened when calling ptp_clock_unregister() on the never-registered PTP clocks.
Fix by returning early in sparx5_ptp_deinit() if PTP is not used.
This page as .md · .json · in your agent: get_signal("CVE-2026-98795")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.