CVE-2026-98562: Linux kernel · net: libwx: fix races in Tx timestamp handling
Affects Linux kernelSource CVE Database V5
Not known to be exploited : upgrade to e78b95cfd5df25d0c562aaef95d3c7fe6c7e0e66 or 3173cba1170131816972ed2b6185cb970ba8b747 when convenient.
Data as of 26 Oct 2026, 14:05 UTC
Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 8% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in e78b95cfd5df25d0c562aaef95d3c7fe6c7e0e66, 3173cba1170131816972ed2b6185cb970ba8b747
Exploitation evidence
Disclosed: evidence found.
CVE published 18 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade Linux kernel to e78b95cfd5df25d0c562aaef95d3c7fe6c7e0e66 or 3173cba1170131816972ed2b6185cb970ba8b747.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in– |
Debiandebian/linuxpkg:deb/debian/linuxOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
A fix is available in the Linux kernel versions identified by commits e78b95cfd5df25d0c562aaef95d3c7fe6c7e0e66 and 3173cba1170131816972ed2b6185cb970ba8b747. Users and administrators should update to these fixed versions to resolve the race conditions. No additional mitigation is required beyond applying the official patch.
Description
A race condition in the Linux kernel's net: libwx Tx timestamp handling was fixed. The issue involved concurrent access to wx->ptp_tx_skb between transmission, auxiliary worker, and cleanup paths, leading to potential use-after-free and reference leaks. A dedicated spinlock was introduced to serialize access and prevent these races. The fix also addresses error handling during Tx DMA mapping failures to avoid mistaken timestamp requests.