CVE-2026-98562: Linux Kernel Race Condition Vulnerability

CVE-2026-98562 Overview

CVE-2026-98562 is a race condition vulnerability in the Linux kernel's libwx network driver. The flaw affects Tx (transmit) timestamp handling in the Precision Time Protocol (PTP) code path. The shared wx->ptp_tx_skb pointer is accessed by the Tx path, the PTP auxiliary worker, and the timestamp cleanup paths without adequate serialization.

The WX_STATE_PTP_TX_IN_PROGRESS bit prevents concurrent Tx timestamp submissions but does not synchronize the worker against cleanup. This creates a window where wx_ptp_clear_tx_timestamp() can free an skb that wx_ptp_tx_hwtstamp_work() still references, leading to use-after-free and double-free conditions.

Critical Impact
The race allows kernel memory corruption through use-after-free on socket buffers, which can cause kernel panics or potentially enable local privilege escalation on affected systems.

Affected Products

Linux kernel libwx network driver (Wangxun Ethernet driver family)
Stable kernel branches referenced in commits 3173cba1170131816972ed2b6185cb970ba8b747 and e78b95cfd5df25d0c562aaef95d3c7fe6c7e0e66
Systems using Wangxun NICs with PTP hardware timestamping enabled

Discovery Timeline

2026-10-18 - CVE-2026-98562 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-98562

Vulnerability Analysis

The vulnerability is a race condition [CWE-362] in the libwx driver's PTP Tx timestamp handling. Three concurrent execution contexts share the wx->ptp_tx_skb pointer: the transmit path that publishes an skb for timestamping, the PTP auxiliary worker that consumes the timestamp, and the cleanup path that releases the reference.

The existing WX_STATE_PTP_TX_IN_PROGRESS bit only guards against multiple transmit paths publishing simultaneously. It does not prevent wx_ptp_clear_tx_timestamp() from freeing an skb while wx_ptp_tx_hwtstamp_work() holds the same pointer. The worker can then pass the freed buffer to skb_tstamp_tx(), releasing the reference a second time.

A secondary race exists where cleanup clears the in-progress bit while the worker is still processing the previous skb. The Tx path can then publish a new skb that the worker overwrites with NULL, leaking the kernel reference.

Root Cause

The root cause is insufficient serialization between asynchronous consumers of a shared pointer. State-bit synchronization protects publication but not the lifetime of the referenced skb across worker and cleanup contexts.

Attack Vector

Triggering the race requires a Wangxun NIC with hardware timestamping enabled and traffic patterns that exercise concurrent Tx, PTP worker, and cleanup paths. The condition is more easily reproduced under heavy PTP load, PCIe error recovery, or network driver quiesce operations. Successful exploitation produces kernel memory corruption rather than direct remote compromise.

The fix introduces a dedicated spinlock that serializes publication and consumption of the Tx timestamp skb. The patch detaches the skb and clears the in-progress bit under the lock, then delivers the timestamp after releasing the lock. The spinlock is acquired with interrupts disabled because netpoll can invoke ndo_start_xmit() with hard interrupts already off.

Detection Methods for CVE-2026-98562

Indicators of Compromise

Kernel oops or panic traces referencing wx_ptp_tx_hwtstamp_work, wx_ptp_clear_tx_timestamp, or skb_tstamp_tx in the call stack
KASAN use-after-free reports naming the libwx driver on hosts with Wangxun NICs
Unexpected skb reference leaks observed through /proc/net/sockstat growth on PTP-enabled interfaces

Detection Strategies

Enable CONFIG_KASAN on test kernels to surface use-after-free conditions in the libwx PTP path
Monitor kernel ring buffer messages for driver-level warnings during PCIe error recovery events
Correlate NIC driver crashes with PTP timestamp workload spikes to identify race condition triggers

Monitoring Recommendations

Centralize kernel logs from Linux hosts with Wangxun NICs into a SIEM for pattern analysis of libwx faults
Track kernel version inventory across the fleet to identify unpatched hosts running vulnerable libwx builds
Alert on repeated NIC driver resets or link flaps that may indicate race-induced instability

How to Mitigate CVE-2026-98562

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in commits 3173cba and e78b95c as soon as distribution updates are available
Inventory systems using Wangxun NICs with PTP hardware timestamping to prioritize patching
Where patching is delayed, consider disabling PTP hardware timestamping on exposed libwx interfaces

Patch Information

The fix is available in the mainline Linux kernel through the commits Kernel Git Commit 3173cba and Kernel Git Commit e78b95c. The patch adds a dedicated spinlock protecting wx->ptp_tx_skb publication and consumption, retains the transmit path reference during DMA mapping failure handling, and performs register-free detachment in the quiesce path to accommodate unreliable MMIO during PCIe error recovery.

Workarounds

Disable PTP Tx hardware timestamping on affected interfaces using hwstamp_ctl until the kernel is updated
Avoid running workloads that stress PCIe error recovery paths on unpatched systems with Wangxun NICs
Pin network traffic away from libwx-managed interfaces where PTP is required but patching is not yet possible

bash

# Disable Tx hardware timestamping on the affected interface
sudo hwstamp_ctl -i <interface> -t 0 -r 0

# Verify the current timestamping configuration
sudo ethtool -T <interface>