From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D36744D2EDF for ; Sun, 18 Oct 2026 15:29:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792337349; cv=none; b=HKHCVwWdLPCpCFHY7JdPcYum51Q8IkRcy1EdbqPfJS0SL+jMMkxiAeBpg8NGrjr03n7o5JnhE+p/tGXTqW3xiSHtHU7PnotbgTeMFcphrRs5/JGyQUyTwrmQlnnhc5folMMuZXx52XXLwW/KDgRm9HhwE9Td7gxHRzdmQfJPMGY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792337349; c=relaxed/simple; bh=gAYuCQykUTwXb1DCxd9H6f+1P1GbDm4jxE6+zLmFu94=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=G1YNx1/vnzkCYkcdXsUKMBDTMpj9qfuEs/z1yCMNMgl7yt4VmJzzrvTXtuz6TJ1hinPOh+05gMsNsL7nOAaDGbsGZnGi2pO+jUW8yCWFVMZv9P5xgCtz/i/Y7RD25hzS8dkD09FfkySgyllGruV0Eb9BPqj5RPrA0n1JoEK8ovU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=NloLnSBa; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="NloLnSBa" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7FB571F000C4; Sun, 18 Oct 2026 15:29:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1792337346; bh=f1fZ69Gt1gtj+/3QPfUh6GYoMco7y+9fs6r/WmigVUg=; h=From:To:Cc:Subject:Date:Reply-To; b=NloLnSBaDOnEdJbn012wq7q1RHJGqHNHVzD1g3vVXzUDZNv7VYTX7KuZy8iuYOLK/ E0uh2DOOXgVOiMgzMzhQzJol3SUj4+EzDOWAYneBpYOg/6v64GhaYZz/kyXbAHYeim ocORarnSByNHsNGXv1oR+PvoFQMETf2Oxm0rJKE0= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-98562: net: libwx: fix races in Tx timestamp handling Date: Sun, 18 Oct 2026 17:17:06 +0200 Message-ID: <2026101830-CVE-2026-98562-1553@gregkh> X-Mailer: git-send-email 2.56.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3435; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=Prf6Q5JNc3tSGVIMR0eApRGNrLccCotzYONO4Lpdiow=; b=owGbwMvMwCRo6H6F97bub03G02pJDFlXHk36fWnf4ZNb4rPjzNh8GTqs5bxZLhnvNja9eO2Mz 0qjubdzOmJZGASZGGTFFFm+bOM5ur/ikKKXoe1pmDmsTCBDGLg4BWAil/gZ5vveunSu9GfWwWST wmP5IRE3Tu8oPsUwv9D6boeuu+zFzY1vKo6q3MvYEBRyHAA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: net: libwx: fix races in Tx timestamp handling wx->ptp_tx_skb is shared between the Tx path, the PTP auxiliary worker and the timestamp cleanup paths. The WX_STATE_PTP_TX_IN_PROGRESS bit prevents multiple Tx paths from submitting timestamp requests, but does not serialize the worker against cleanup. As a result, wx_ptp_clear_tx_timestamp() can free an skb after wx_ptp_tx_hwtstamp_work() has obtained its pointer. The worker may then pass the freed skb to skb_tstamp_tx() and release the same reference again. The cleanup path may also clear the in-progress bit while the worker is still processing the old skb. This allows the Tx path to publish a new skb which the worker can subsequently overwrite with NULL, leaking its reference. Add a dedicated spinlock to protect publication and consumption of the Tx timestamp skb. Detach the skb and clear the in-progress bit while holding the lock, then deliver the timestamp and release the skb after dropping it. Use the same locked cleanup in the quiesce path, but keep the detach there free of register accesses: quiesce runs during PCIe error recovery, where MMIO is not reliable, and it deliberately did not touch the device before. The lock is taken with interrupts disabled, because netpoll can call ndo_start_xmit() with hard interrupts already off. When handling a Tx DMA mapping failure, keep the transmit path reference until after comparing the skb under the lock. This prevents skb address reuse from making the error path mistake a newer timestamp request for the failed one. The Linux kernel CVE team has assigned CVE-2026-98562 to this issue. Affected and fixed versions =========================== Issue introduced in 6.15 with commit 06e75161b9d4833518a7c266310a0635eab50616 and fixed in 7.2.9 with commit e78b95cfd5df25d0c562aaef95d3c7fe6c7e0e66 Issue introduced in 6.15 with commit 06e75161b9d4833518a7c266310a0635eab50616 and fixed in 7.3-rc5 with commit 3173cba1170131816972ed2b6185cb970ba8b747 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-98562 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/net/ethernet/wangxun/libwx/wx_hw.c drivers/net/ethernet/wangxun/libwx/wx_lib.c drivers/net/ethernet/wangxun/libwx/wx_ptp.c drivers/net/ethernet/wangxun/libwx/wx_type.h Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/e78b95cfd5df25d0c562aaef95d3c7fe6c7e0e66 https://git.kernel.org/stable/c/3173cba1170131816972ed2b6185cb970ba8b747