Cloudanix VulnDB

CVE-2026-98791

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in Linux networking code for certain high-speed cards could let a local attacker crash the entire machine during specific network operations.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Null pointer dereference in mlx5e AF_XDP TX timestamp completion path during XSK queue teardown when no CQE is available, allowing mlx5e_xsk_fill_timestamp to be called with NULL.

Why it matters to the business

Kernel crashes or denial of service on Linux systems using Mellanox mlx5e drivers with AF_XDP, resulting in unplanned downtime and potential loss of network connectivity for affected workloads.

How an attack unfolds

An attacker with local access sets up an AF_XDP socket requesting TX timestamps, forces XSK TX queue teardown with outstanding descriptors lacking a CQE, and triggers the completion handler to dereference the null pointer.

How to fix it

Upgrade to a Linux kernel containing the fix that returns zero from mlx5e_xsk_fill_timestamp when no CQE is present during XSK TX teardown.

How to confirm the fix worked

Confirm the running kernel source includes the resolution for the AF_XDP TX timestamp teardown NULL dereference in net/mlx5e; test AF_XDP TX queue creation and teardown under load.

Typical attack path

  1. Obtain local code execution on target Linux system
  2. Create AF_XDP TX queue with timestamp requests enabled
  3. Initiate queue teardown without a valid CQE
  4. Trigger null dereference in mlx5e_xsk_fill_timestamp leading to panic

How to detect it

Inspect kernel logs and dmesg for null pointer dereference oops or panics referencing mlx5e, XSK, or TX timestamp teardown paths; correlate with processes using AF_XDP sockets.

What your security team should do

  • Prioritize kernel updates for systems exposing mlx5e with AF_XDP
  • Disable AF_XDP on unpatched mlx5e interfaces where feasible
  • Monitor kernel logs for oops involving mlx5e_xsk_fill_timestamp

The record

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereference During XSK TX queue teardown, outstanding descriptors are completed without a CQE. If one requested a TX timestamp, the completion path passes that NULL CQE to mlx5e_xsk_fill_timestamp(), which dereferences it. Return zero when no CQE is available, indicating that teardown did not produce a TX timestamp.

Affected packages

Ecosystem Package Introduced Fixed