CVE-2026-98913 in Linux
Summary
by MITRE • 10/23/2026
In the Linux kernel, the following vulnerability has been resolved:
net: thunderx: fix PTP device ref leak in nicvf_probe()
cavium_ptp_get() acquires a reference to the PTP PCI device through pci_get_device(). If any initialization step fails after cavium_ptp_get(), the PTP PCI device reference is leaked. Add a common error path to release the PTP reference before returning from probe failures.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The Linux kernel networking driver for Cavium ThunderX systems contains a resource management flaw within its probing routine, specifically involving the Precision Time Protocol hardware abstraction layer. During the initialization phase of the network interface card, the function cavium_ptp_get is invoked to acquire a reference count on the associated PCI device representing the PTP clock source. This operation utilizes pci_get_device, which increments the kernel's internal reference counter for that specific PCI device structure to ensure it remains active and accessible while in use by the driver. The vulnerability arises from an asymmetry in resource handling where this acquired reference is not properly released if subsequent initialization steps encounter errors or fail conditions.
In a typical probe sequence, multiple subsystems are initialized sequentially, including memory allocation for internal structures, registration of interrupt handlers, configuration of hardware registers, and binding to the network stack. If any single step within this chain fails after the PTP device reference has been acquired but before it is released, the current implementation lacks a unified error handling path that decrements the reference count via pci_dev_put or equivalent mechanisms. Consequently, when the probe function returns an error code to indicate failure, the kernel retains a dangling reference to the PCI device without corresponding cleanup actions for other allocated resources. This results in a resource leak where the reference counter remains elevated indefinitely until the system is rebooted or the module is forcibly removed under specific conditions that might allow partial teardown.
From a technical perspective, this flaw aligns with CWE-401, which describes missing release of memory after successful allocation, and more specifically CWE-756 regarding improper use of reference counting mechanisms in operating systems. The lack of a common error path violates standard defensive programming practices where every acquisition must have a corresponding deallocation on all exit paths, including failure branches. In the context of MITRE ATT&CK, this type of vulnerability can be categorized under T1496 Resource Hijacking if an attacker could trigger repeated probe failures to exhaust system resources over time, although in practice, it primarily manifests as a gradual degradation of system stability due to kernel memory and reference count exhaustion rather than immediate exploitation for privilege escalation.
The operational impact of this vulnerability is characterized by the progressive accumulation of unreleased device references within the kernel space. While a single leak may have negligible effects on modern systems with abundant resources, repeated occurrences during driver reloads or hot-plug events can lead to resource starvation. This can prevent other drivers from accessing PCI devices, cause warnings in dmesg logs regarding leaked objects, and potentially contribute to system instability or crashes if the reference count limits are approached. Furthermore, such leaks complicate debugging efforts as they obscure true memory usage patterns and make it difficult to determine which subsystems are holding onto resources unnecessarily.
To mitigate this vulnerability, developers must implement a centralized error handling path within the nicvf_probe function that ensures all acquired references are released before returning on failure. This involves refactoring the probe logic to jump to a common cleanup label upon encountering any initialization error, where pci_dev_put is called for the PTP device reference alongside other necessary teardown operations such as freeing allocated memory and unregistering hardware components. Adopting this pattern not only resolves the immediate leak but also improves code maintainability by consolidating cleanup logic in one location rather than scattering it across multiple conditional branches. Regular static analysis tools should be employed to detect similar patterns in future development cycles, ensuring that every pci_get_device call is paired with a corresponding release mechanism on all execution paths.