In the Linux kernel, the following vulnerability has been resolved: net: libwx: fix races in Tx timestamp handling wx->ptp_tx_skb is shared between… (CVE-2026-98562)

The vulnerability in the Linux kernel's net: libwx component stemmed from race conditions in the transmission (Tx) timestamp handling. The shared pointer wx->ptp_tx_skb was accessed concurrently by the Tx path, the PTP auxiliary worker, and cleanup paths without proper serialization. The WX_STATE_PTP_TX_IN_PROGRESS bit prevented multiple Tx submissions but did not protect the worker against cleanup races. This led to scenarios where the skb could be freed while still in use, causing double frees or reference leaks. The fix introduced a dedicated spinlock to protect publication and consumption of the Tx timestamp skb, ensuring proper synchronization. The lock is taken with interrupts disabled to accommodate netpoll's behavior. Additional handling was added for Tx DMA mapping failures to prevent address reuse errors.

The race conditions could cause memory corruption through double freeing of skb structures or leaking skb references, potentially leading to kernel instability or crashes. No direct exploitation or active attacks are reported. The impact is primarily on kernel reliability and memory safety in the affected networking code.

A fix has been implemented in the Linux kernel to address the race conditions by adding a dedicated spinlock and improving synchronization in the Tx timestamp handling paths. Users should update to the patched kernel version containing this fix. No additional mitigation steps are indicated.