Cloudanix VulnDB

CVE-2026-98795

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A driver bug in certain network chips can crash the whole system when the driver is removed if a special timing feature was never turned on.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

NULL pointer dereference during driver removal when sparx5_ptp_init skipped initialization of tx_skbs queues on lan969x variants lacking SPX5_FEATURE_PTP or ptp interrupt, leading to skb_queue_purge_reason crash in sparx5_ptp_deinit.

Why it matters to the business

Kernel panic and system instability possible on driver unbind for affected network hardware, causing downtime during device management or hotplug operations.

How an attack unfolds

An attacker with local access loads the sparx5 driver on vulnerable hardware where PTP init returns early, then triggers driver removal or unbind to dereference uninitialized structures and crash the kernel.

How to fix it

Apply upstream kernel patch that adds early return in sparx5_ptp_deinit when PTP was not initialized; rebuild and deploy updated kernel image to affected systems.

How to confirm the fix worked

Inspect sparx5_ptp.c for conditional guard before skb_queue_purge_reason and ptp_clock_unregister calls; reproduce bind/unbind cycle on lan969x hardware and confirm absence of NULL dereference oops.

Typical attack path

  1. Identify system using mchp_sparx5 platform driver on lan969x without PTP feature or interrupt
  2. Ensure driver binds successfully with early return from sparx5_ptp_init
  3. Trigger platform_remove or device unbind path
  4. Execute sparx5_ptp_deinit which calls skb_queue_purge_reason on NULL queues

How to detect it

Search kernel logs for oops involving skb_queue_purge_reason and sparx5_ptp_deinit call stack during platform_remove or mchp_sparx5_remove; correlate with driver bind events on lan969x hardware.

  • skb_queue_purge_reason+0x68/0x120
  • sparx5_ptp_deinit+0x64/0xc0
  • mchp_sparx5_remove+0x38/0x70
  • Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008

What your security team should do

  • Prioritize kernel update containing the deinit guard within maintenance windows for network devices
  • Audit driver load/unload paths in staging or test environments for similar init/deinit mismatches
  • Monitor for related oops reports in kernel logs on Sparx5-based platforms

The record

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: skip ptp deinit if init was skipped sparx5_ptp_init() returns early on the base lan969x variants because they do not have the SPX5_FEATURE_PTP flag. It also returns early when no "ptp" interrupt is described. Unbinding the driver then causes a NULL pointer dereference when cleaning up uninitialized tx_skbs queues: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 Call trace: skb_queue_purge_reason+0x68/0x120 (P) sparx5_ptp_deinit+0x64/0xc0 mchp_sparx5_remove+0x38/0x70 platform_remove+0x20/0x30 device_remove+0x4c/0x80 Before per-port tx_skbs were added, a NULL dereference would have happened when calling ptp_clock_unregister() on the never-registered PTP clocks. Fix by returning early in sparx5_ptp_deinit() if PTP is not used.

Affected packages

Ecosystem Package Introduced Fixed