CVE-2026-98791: net/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereference
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Fix AFXDP TX timestamp teardown NULL dereference
During XSK TX queue teardown, outstanding descriptors are completed without a CQE. If one requested a TX timestamp, the completion path passes that NULL CQE to mlx5exskfilltimestamp(), which dereferences it.
Return zero when no CQE is available, indicating that teardown did not produce a TX timestamp.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel mlx5e driver with AF_XDP transmit queues are exposed when TX timestamping is requested. The affected teardown path involves outstanding XSK TX descriptors that are completed without a completion queue entry (CQE).
What condition triggers the NULL dereference?
The issue occurs during XSK TX queue teardown when an outstanding descriptor requested a TX timestamp. Because teardown completes that descriptor without a CQE, the timestamp completion path receives a NULL CQE and dereferences it.
What happens after applying the fix?
When no CQE is available during teardown, the timestamp helper returns zero rather than dereferencing the NULL CQE. This indicates that teardown did not produce a TX timestamp.