CVE-2026-98562 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
net: libwx: fix races in Tx timestamp handling
wx->ptp_tx_skb is shared between the Tx path, the PTP auxiliary worker and the timestamp cleanup paths. The WX_STATE_PTP_TX_IN_PROGRESS bit prevents multiple Tx paths from submitting timestamp requests, but does not serialize the worker against cleanup.
As a result, wx_ptp_clear_tx_timestamp() can free an skb after wx_ptp_tx_hwtstamp_work() has obtained its pointer. The worker may then pass the freed skb to skb_tstamp_tx() and release the same reference again.
The cleanup path may also clear the in-progress bit while the worker is still processing the old skb. This allows the Tx path to publish a new skb which the worker can subsequently overwrite with NULL, leaking its reference.
Add a dedicated spinlock to protect publication and consumption of the Tx timestamp skb. Detach the skb and clear the in-progress bit while holding the lock, then deliver the timestamp and release the skb after dropping it. Use the same locked cleanup in the quiesce path, but keep the detach there free of register accesses: quiesce runs during PCIe error recovery, where MMIO is not reliable, and it deliberately did not touch the device before. The lock is taken with interrupts disabled, because netpoll can call ndo_start_xmit() with hard interrupts already off.
When handling a Tx DMA mapping failure, keep the transmit path reference until after comparing the skb under the lock. This prevents skb address reuse from making the error path mistake a newer timestamp request for the failed one.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/18/2026
The Linux kernel vulnerability identified in the net: libwx driver involves critical race conditions within the transmission (Tx) hardware timestamping subsystem, specifically affecting how socket buffers are managed between concurrent execution contexts. The core issue stems from the shared access to the wx->ptp_tx_skb pointer across three distinct operational paths: the primary Tx path responsible for submitting packets, a PTP auxiliary worker thread that processes timestamps, and various cleanup routines. While the existing mechanism utilizing the WX_STATE_PTP_TX_IN_PROGRESS bit successfully prevents multiple Tx threads from simultaneously initiating new timestamp requests, it fails to provide mutual exclusion between the asynchronous worker processing an old request and the cleanup logic attempting to free resources associated with that same request. This lack of serialization creates a window for use-after-free scenarios where memory safety is compromised due to improper synchronization primitives.
The operational impact of this flaw manifests in two primary failure modes, both leading to potential kernel instability or information leakage. In the first scenario, the cleanup function wx_ptp_clear_tx_timestamp() may deallocate and free an skb after the worker thread has already retrieved its pointer for processing. Consequently, when the worker proceeds to invoke skb_tstamp_tx(), it operates on a memory region that is no longer valid, potentially causing a kernel panic or data corruption. Furthermore, this race condition can lead to double-free vulnerabilities if the cleanup path releases references that have already been consumed by the worker logic. In the second scenario, the cleanup routine may clear the in-progress flag while the worker is still actively processing an older skb. This premature state change allows the Tx path to publish a new skb into the shared pointer location before the previous operation has fully concluded. The worker subsequently overwrites this newly published reference with NULL, effectively leaking its own reference count and resulting in memory leaks that degrade system performance over time.
To resolve these concurrency issues, the fix introduces a dedicated spinlock specifically designed to protect the publication and consumption of Tx timestamp skbs. This synchronization primitive ensures atomicity during critical sections where state transitions occur. The implementation strategy involves detaching the skb from its current context and clearing the in-progress bit while holding this lock, thereby guaranteeing that no other thread can access or modify the pointer concurrently. Once the lock is released, the worker safely delivers the timestamp data via skb_tstamp_tx() and then releases the reference to the buffer. This approach strictly serializes access to the shared resource, eliminating the race conditions described above. The solution also adapts this locking mechanism for use in quiesce paths during PCIe error recovery. In these specific contexts, MMIO operations are unreliable, so the implementation deliberately avoids touching device registers while holding the lock, maintaining compatibility with hardware constraints while still ensuring memory safety through software-level synchronization.
The technical design of the fix accounts for complex interrupt handling environments by taking the spinlock with interrupts disabled. This decision is driven by the behavior of netpoll, which can invoke ndo_start_xmit() when hard interrupts are already masked. Without disabling interrupts during lock acquisition, there would be a risk of deadlock or inconsistent state if an interrupt handler attempted to access the same protected resource while it was locked in process context. Additionally, the fix addresses edge cases involving Tx DMA mapping failures by retaining the transmit path reference until after comparing the skb under the protection of the spinlock. This prevents address reuse attacks where a failed transmission might be mistakenly identified as a newer timestamp request due to memory recycling patterns, ensuring that error handling paths do not inadvertently corrupt state or leak references based on stale pointer comparisons.
From a vulnerability classification perspective, this issue aligns with CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization, commonly known as a race condition. The specific nature of the bug involves shared memory access without adequate locking mechanisms to prevent simultaneous read-write conflicts between kernel threads and interrupt contexts. In terms of attack vectors, while primarily affecting system stability rather than direct remote exploitation, such vulnerabilities can be leveraged for local privilege escalation if an attacker can trigger repeated Tx timestamp operations under high load conditions, potentially leading to denial-of-service through kernel crashes or resource exhaustion via memory leaks. The mitigation strategy reflects best practices outlined in ATT&CK techniques related to execution and defense evasion by ensuring that critical system resources are properly guarded against concurrent modification attempts.
The resolution emphasizes the importance of fine-grained locking strategies in network driver development, particularly for features involving asynchronous hardware interactions like PTP timestamping. By isolating the synchronization scope to only what is necessary and adapting it to specific operational constraints such as PCIe error recovery modes, the fix maintains both security integrity and system reliability. The explicit handling of interrupt contexts further demonstrates a deep understanding of kernel scheduling behaviors, ensuring that the protection mechanism does not introduce new deadlocks or latency issues in high-throughput networking scenarios. This comprehensive approach ensures that all code paths accessing the shared skb pointer are serialized correctly, preventing use-after-free errors, double frees, and memory leaks that could otherwise compromise the stability of the Linux network stack.