CVE-2026-98795: net: sparx5: skip ptp deinit if init was skipped
In the Linux kernel, the following vulnerability has been resolved:
net: sparx5: skip ptp deinit if init was skipped
sparx5ptpinit() returns early on the base lan969x variants because they do not have the SPX5FEATUREPTP flag. It also returns early when no "ptp" interrupt is described. Unbinding the driver then causes a NULL pointer dereference when cleaning up uninitialized txskbs queues:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 Call trace: skbqueuepurgereason+0x68/0x120 (P) sparx5ptpdeinit+0x64/0xc0 mchpsparx5remove+0x38/0x70 platformremove+0x20/0x30 deviceremove+0x4c/0x80
Before per-port txskbs were added, a NULL dereference would have happened when calling ptpclockunregister() on the never-registered PTP clocks.
Fix by returning early in sparx5ptpdeinit() if PTP is not used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Update sparx5_ptp_deinit() to return early when PTP is not used or sparx5_ptp_init() was skipped, including base lan969x variants without a "ptp" interrupt, so it does not purge uninitialized tx_skbs queues or unregister never-registered PTP clocks.