In the Linux kernel, the following vulnerability has been resolved: net: thunderx: fix PTP device ref leak in nicvf_probe() cavium_ptp_get()… (CVE-2026-98913)

The vulnerability in the Linux kernel's ThunderX network driver (nicvf_probe function) was due to cavium_ptp_get() acquiring a reference to the PTP PCI device via pci_get_device(). If any initialization step after this acquisition failed, the reference was not released, resulting in a PTP device reference leak. The fix introduced a common error path to release the PTP reference before returning from probe failures, preventing the leak.

The issue causes a resource leak of the PTP PCI device reference in the kernel, which could lead to resource exhaustion or instability in the affected system over time. There is no indication of direct exploitation or further impact such as privilege escalation or code execution.

The vulnerability has been resolved in the Linux kernel by adding proper cleanup code to release the PTP device reference on initialization failure. Users should apply the official Linux kernel update containing this fix. No additional mitigation is required beyond applying the patch.