CVE-2026-98791 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereference
During XSK TX queue teardown, outstanding descriptors are completed without a CQE. If one requested a TX timestamp, the completion path passes that NULL CQE to mlx5e_xsk_fill_timestamp(), which dereferences it.
Return zero when no CQE is available, indicating that teardown did not produce a TX timestamp.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/18/2026
The Linux kernel network subsystem contains a critical flaw within the Mellanox ConnectX driver implementation of AF_XDP transmit queue handling. This vulnerability manifests as a NULL pointer dereference during the cleanup phase of an XSK (AF_XDP socket) transmission queue. The issue arises specifically when the system attempts to tear down or release resources associated with a transmit queue that has pending operations requiring hardware timestamping. Under normal operational conditions, network drivers rely on Completion Queue Entries generated by the hardware to signal the completion of transmitted packets and provide metadata such as timestamps. However, during the teardown process, outstanding descriptors are completed without waiting for or receiving these standard CQEs from the hardware interface.
The technical root cause lies in the error handling path within the mlx5e_xsk_fill_timestamp function. When a packet transmission is initiated with a request for a TX timestamp, the driver expects to retrieve this information via a subsequent CQE. In the context of queue teardown, no such completion event occurs because the hardware interface is being dismantled or reset before it can generate the necessary status reports. Consequently, the code path attempts to pass a NULL pointer representing the missing CQE directly into mlx5e_xsk_fill_timestamp(). This function subsequently dereferences this null reference in an attempt to extract timestamp data, triggering a kernel panic or segmentation fault that compromises system stability and availability.
From a security perspective, this vulnerability is classified under CWE-476, which denotes NULL Pointer Dereference. The operational impact of this flaw includes denial of service against the host machine running the affected Linux kernel version. An attacker with local access who can create and destroy AF_XDP sockets or manipulate network interfaces could potentially trigger this condition repeatedly to cause system crashes. This aligns with MITRE ATT&CK technique T1499, Endpoint Denial of Service, as it allows for resource exhaustion through instability rather than simple consumption limits. The vulnerability affects the integrity and availability aspects of the CIA triad by causing unexpected kernel panics that require a reboot or service restart to resolve.
Mitigation strategies primarily involve applying vendor-provided patches that update the mlx5e driver logic. The fix ensures that when no CQE is available during teardown, the function returns zero instead of attempting to dereference invalid memory addresses. This logical correction prevents the crash and allows for graceful resource cleanup. Administrators should ensure their systems are updated with the latest kernel packages containing this specific patch. Additionally, monitoring system logs for oops or panic traces related to mlx5e drivers can help identify if any instances of this vulnerability have been triggered in production environments before patches are fully deployed across all nodes.