CVE-2026-98562 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux-based systems should assess exposure and verify the Tx timestamp handling implementation.

Why it matters

A vulnerability in the Linux kernel's net: libwx Tx timestamp handling has been addressed. Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux-based systems should assess exposure and verify the Tx timestamp handling implementation.

• Potential use-after-free issues in the Linux kernel
• Verification of Tx timestamp handling implementation required
• Monitoring for potential issues recommended

Technical summary

The Linux kernel's net: libwx Tx timestamp handling had a vulnerability where the WX_STATE_PTP_TX_IN_PROGRESS bit did not prevent the PTP auxiliary worker from freeing an skb after the Tx path obtained its pointer. This could lead to use-after-free issues. A dedicated spinlock has been added to protect publication and consumption of the Tx timestamp skb, detaching the skb and clearing the in-progress bit while holding the lock, then delivering the timestamp and releasing the skb after dropping it. The lock is taken with interrupts disabled, because netpoll can call ndo_start_xmit() with hard interrupts already off. When handling a Tx DMA mapping failure, keep the transmit path reference until after comparing

Defensive priority

Medium

Recommended defensive actions

• Review and apply the Linux kernel patch to address the vulnerability
• Verify the Tx timestamp handling implementation in the Linux kernel
• Monitor for potential use-after-free issues in the Linux kernel
• Perform a thorough review of the Linux kernel's net: libwx Tx timestamp handling implementation
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but evidence is limited. The Linux kernel patch notes and Git commit hashes are provided as references. Further verification of Tx timestamp handling implementation is required to assess exposure. Linux kernel developers and maintainers should review the patch and apply it to address the vulnerability. The patch adds a dedicated spinlock to protect publication and consumption of the Tx timestamp skb, detaching the skb and clearing the in-progress bit while holding the

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.