---
id: "CVE-2026-98795"
kind: "vulnerability"
aliases: ["CVE-2026-98795"]
title: "Linux kernel: sparx5 driver unbind crashes on NULL pointer dereference"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["embedded", "lan969x", "linux-kernel", "runtime", "sparx5"]
not_affected_if: ["no-sparx5-hardware"]
published_at: "2026-10-18T16:17:33+00:00"
first_seen_at: "2026-10-23T21:57:16+00:00"
updated_at: "2026-10-25T05:15:09+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98795", "first_seen_at": "2026-10-23T21:57:16+00:00"}]
---

# Linux kernel: sparx5 driver unbind crashes on NULL pointer dereference

In the Linux kernel's Microchip sparx5 network driver, unbinding the driver on lan969x variants without PTP support dereferences an uninitialized queue and crashes the kernel. The sources describe a local kernel NULL pointer dereference during driver removal and do not describe a remote attacker path.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-23T21:57:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98795

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

net: sparx5: skip ptp deinit if init was skipped

sparx5_ptp_init() returns early on the base lan969x variants
because they do not have the SPX5_FEATURE_PTP flag. It also returns early
when no "ptp" interrupt is described. Unbinding the driver then causes a
NULL pointer dereference when cleaning up uninitialized tx_skbs queues:

    Unable to handle kernel NULL pointer dereference at virtual address
    0000000000000008
    Call trace:
    skb_queue_purge_reason+0x68/0x120 (P)
    sparx5_ptp_deinit+0x64/0xc0
    mchp_sparx5_remove+0x38/0x70
    platform_remove+0x20/0x30
    device_remove+0x4c/0x80

Before per-port tx_skbs were added, a NULL dereference would have happened
when calling ptp_clock_unregister() on the never-registered PTP clocks.

Fix by returning early in sparx5_ptp_deinit() if PTP is not used.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_