CVE-2026-98913

What it actually does

Reference count leak in nicvf_probe() after cavium_ptp_get() succeeds via pci_get_device() but a later initialization step fails, leaving the PTP PCI device reference unreleased.

Why it matters to the business

On Cavium ThunderX-based systems, repeated driver probe failures can gradually exhaust kernel resources, leading to degraded network functionality or the need for system restarts; low immediate risk given recent publication and minimal exploit predictions.

How an attack unfolds

An attacker with local access or the ability to induce repeated nicvf probe failures (for example via hardware faults or misconfiguration) can trigger the leak path; no remote exploitation or known threat actor usage has been observed.

How to fix it

Apply the upstream kernel patch that introduces a common error path releasing the PTP reference on probe failure; upgrade to a fixed mainline or distribution kernel once available.

How to confirm the fix worked

Inspect the nicvf_probe() error handling paths in the running kernel source or binary for the added PTP reference release; confirm updated kernel packages are installed on affected ThunderX hardware.

Typical attack path

1. Cause repeated failure conditions during nicvf_probe() after PTP reference acquisition
2. Accumulate unreleased device references across multiple attempts
3. Observe gradual kernel resource depletion or driver instability

How to detect it

Search kernel logs and dmesg output for repeated nicvf_probe failures occurring after PTP device acquisition; monitor for steadily increasing references to PTP PCI devices without corresponding releases.

What your security team should do

• Prioritize kernel updates on any Cavium ThunderX systems within the next maintenance window
• Review dmesg and kernel logs for nicvf probe failure patterns
• Track EPSS and KEV status for any change in exploit likelihood