CVE-2026-98562

In the Linux kernel, the following vulnerability has been resolved:

net: libwx: fix races in Tx timestamp handling

wx->ptp_tx_skb is shared between the Tx path, the PTP auxiliary

worker and the timestamp cleanup paths. The

WX_STATE_PTP_TX_IN_PROGRESS bit prevents multiple Tx paths from

submitting timestamp requests, but does not serialize the worker

against cleanup.

As a result, wx_ptp_clear_tx_timestamp() can free an skb after

wx_ptp_tx_hwtstamp_work() has obtained its pointer. The worker may

then pass the freed skb to skb_tstamp_tx() and release the same

reference again.

The cleanup path may also clear the in-progress bit while the worker

is still processing the old skb. This allows the Tx path to publish a

new skb which the worker can subsequently overwrite with NULL,

leaking its reference.

Add a dedicated spinlock to protect publication and consumption of

the Tx timestamp skb. Detach the skb and clear the in-progress bit

while holding the lock, then deliver the timestamp and release the skb

after dropping it. Use the same locked cleanup in the quiesce path,

but keep the detach there free of register accesses: quiesce runs

during PCIe error recovery, where MMIO is not reliable, and it

deliberately did not touch the device before. The lock is taken with

interrupts disabled, because netpoll can call ndo_start_xmit() with

hard interrupts already off.

When handling a Tx DMA mapping failure, keep the transmit path

reference until after comparing the skb under the lock. This prevents

skb address reuse from making the error path mistake a newer timestamp

request for the failed one.