CVE-2026-98562: net: libwx: fix races in Tx timestamp handling

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net: libwx: fix races in Tx timestamp handling

wx->ptp_tx_skb is shared between the Tx path, the PTP auxiliary
worker and the timestamp cleanup paths. The
WX_STATE_PTP_TX_IN_PROGRESS bit prevents multiple Tx paths from
submitting timestamp requests, but does not serialize the worker
against cleanup.

As a result, wx_ptp_clear_tx_timestamp() can free an skb after
wx_ptp_tx_hwtstamp_work() has obtained its pointer. The worker may
then pass the freed skb to skb_tstamp_tx() and release the same
reference again.

The cleanup path may also clear the in-progress bit while the worker
is still processing the old skb. This allows the Tx path to publish a
new skb which the worker can subsequently overwrite with NULL,
leaking its reference.

Add a dedicated spinlock to protect publication and consumption of
the Tx timestamp skb. Detach the skb and clear the in-progress bit
while holding the lock, then deliver the timestamp and release the skb
after dropping it. Use the same locked cleanup in the quiesce path,
but keep the detach there free of register accesses: quiesce runs
during PCIe error recovery, where MMIO is not reliable, and it
deliberately did not touch the device before. The lock is taken with
interrupts disabled, because netpoll can call ndo_start_xmit() with
hard interrupts already off.

When handling a Tx DMA mapping failure, keep the transmit path
reference until after comparing the skb under the lock. This prevents
skb address reuse from making the error path mistake a newer timestamp
request for the failed one.

The Linux kernel CVE team has assigned CVE-2026-98562 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.15 with commit 06e75161b9d4833518a7c266310a0635eab50616 and fixed in 7.2.9 with commit e78b95cfd5df25d0c562aaef95d3c7fe6c7e0e66
	Issue introduced in 6.15 with commit 06e75161b9d4833518a7c266310a0635eab50616 and fixed in 7.3-rc5 with commit 3173cba1170131816972ed2b6185cb970ba8b747

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-98562
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/ethernet/wangxun/libwx/wx_hw.c
	drivers/net/ethernet/wangxun/libwx/wx_lib.c
	drivers/net/ethernet/wangxun/libwx/wx_ptp.c
	drivers/net/ethernet/wangxun/libwx/wx_type.h


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/e78b95cfd5df25d0c562aaef95d3c7fe6c7e0e66
	https://git.kernel.org/stable/c/3173cba1170131816972ed2b6185cb970ba8b747