CVE-2026-98562
Microsoft — net: libwx: fix races in Tx timestamp handling
Microsoft · Not classified by connected sources
EVRS 0 of 100 Informational
Monitor
Rank 2,877 of 2,960 tracked
Why it scores 0
Evidence available: 2 of 8 signalsNo strong exploitation, disclosure, or severity signal is available for this CVE yet.
- CISA KEVDid not apply
- RansomwareNo data
- Vendor exploitationNo data
- EPSSDid not apply
- Microsoft Exploitability IndexNo data
- Pre-patch disclosureNo data
- KEV recencyNo data
- CVSSNo data
The band answers “how soon”, not “how bad”. No data for: Ransomware, Vendor exploitation, Microsoft Exploitability Index, Pre-patch disclosure, KEV recency, CVSS. Why some signals show no data
Fix
No fixed version identified yetAffected versions
Not identified by the connected sources
Remediation
NVD lists one or more references for this CVE that aren't tagged as a patch or vendor advisory. Review them directly to confirm patch availability and applicability before making a remediation decision.
Evidence
Each value with its source| Measure | Value | Source |
|---|---|---|
| CVSS base scoreHow severe the flaw is in itself. It does not say how likely an attack is. | Not publishedNVD and the CVE record were checked and hold no score. | NVD |
| FIRST EPSSFIRST's estimate of the chance this is exploited in the next 30 days, and how that ranks against all CVEs. | 0.002 (8.1st pctl) | FIRST EPSS |
| Actively exploitedWhether a source of record has confirmed attacks using it in the wild. | Not confirmed | Patch Tuesday |
| Public exploit moduleA module existing is not the same as active exploitation. | None known | Metasploit |
| EUVD cross-referenceENISA's record: CVSS 0.0, assigned by Linux. | Listed | ENISA EUVD |
Description
NVDIn the Linux kernel, the following vulnerability has been resolved: net: libwx: fix races in Tx timestamp handling wx->ptp_tx_skb is shared between the Tx path, the PTP auxiliary worker and the timestamp cleanup paths. The WX_STATE_PTP_TX_IN_PROGRESS bit prevents multiple Tx paths from submitting timestamp requests, but does not serialize the worker against cleanup. As a result, wx_ptp_clear_tx_timestamp() can free an skb after wx_ptp_tx_hwtstamp_work() has obtained its pointer. The worker may then pass the freed skb to skb_tstamp_tx() and release the same reference again. The cleanup path may also clear the in-progress bit while the worker is still processing the old skb. This allows the Tx path to publish a new skb which the worker can subsequently overwrite with NULL, leaking its reference. Add a dedicated spinlock to protect publication and consumption of the Tx timestamp skb. Detach the skb and clear the in-progress bit while holding the lock, then deliver the timestamp and release the skb after dropping it. Use the same locked cleanup in the quiesce path, but keep the detach there free of register accesses: quiesce runs during PCIe error recovery, where MMIO is not reliable, and it deliberately did not touch the device before. The lock is taken with interrupts disabled, because netpoll can call ndo_start_xmit() with hard interrupts already off. When handling a Tx DMA mapping failure, keep the transmit path reference until after comparing the skb under the lock. This prevents skb address reuse from making the error path mistake a newer timestamp request for the failed one.