CVE-2026-98795
Description
In the Linux kernel, the following vulnerability has been resolved: net: sparx5: skip ptp deinit if init was skipped sparx5_ptp_init() returns early on the base lan969x variants because they do not have the SPX5_FEATURE_PTP flag. It also returns early when no "ptp" interrupt is described. Unbinding the driver then causes a NULL pointer dereference when cleaning up uninitialized tx_skbs queues: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 Call trace: skb_queue_purge_reason+0x68/0x120 (P) sparx5_ptp_deinit+0x64/0xc0 mchp_sparx5_remove+0x38/0x70 platform_remove+0x20/0x30 device_remove+0x4c/0x80 Before per-port tx_skbs were added, a NULL dereference would have happened when calling ptp_clock_unregister() on the never-registered PTP clocks. Fix by returning early in sparx5_ptp_deinit() if PTP is not used.
How to fix
- Linux Linux35c706d6eb1963735814c5f5bb2674a96eacf3cc, 2879b65bfa548e10d59c5fba91d17f8a00cd7029, 0d2c49915bc3aea4521cda5e4d42f24f63b94585 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 0933bd04047c3b96ba49545a8f91e7e6f8f666ff ≤ v < 35c706d6eb1963735814c5f5bb2674a96eacf3cc, 0933bd04047c3b96ba49545a8f91e7e6f8f666ff ≤ v < 2879b65bfa548e10d59c5fba91d17f8a00cd7029, 0933bd04047c3b96ba49545a8f91e7e6f8f666ff ≤ v < 0d2c49915bc3aea4521cda5e4d42f24f63b94585, 5.18 | 35c706d6eb1963735814c5f5bb2674a96eacf3cc, 2879b65bfa548e10d59c5fba91d17f8a00cd7029, 0d2c49915bc3aea4521cda5e4d42f24f63b94585 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.