CVE-2026-98795: net: sparx5: skip ptp deinit if init was skipped
In the Linux kernel, the following vulnerability has been resolved:
net: sparx5: skip ptp deinit if init was skipped
sparx5ptpinit() returns early on the base lan969x variants because they do not have the SPX5FEATUREPTP flag. It also returns early when no "ptp" interrupt is described. Unbinding the driver then causes a NULL pointer dereference when cleaning up uninitialized txskbs queues:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 Call trace: skbqueuepurgereason+0x68/0x120 (P) sparx5ptpdeinit+0x64/0xc0 mchpsparx5remove+0x38/0x70 platformremove+0x20/0x30 deviceremove+0x4c/0x80
Before per-port txskbs were added, a NULL dereference would have happened when calling ptpclockunregister() on the never-registered PTP clocks.
Fix by returning early in sparx5ptpdeinit() if PTP is not used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Modify sparx5_ptp_deinit() to return early when PTP initialization was skipped, including on lan969x variants without SPX5_FEATURE_PTP or when no "ptp" interrupt is described.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel Sparx5 network driver are exposed when PTP initialization is skipped. This includes base LAN969x variants that lack the SPX5_FEATURE_PTP flag and systems where no "ptp" interrupt is described.
What action triggers the NULL pointer dereference?
The fault occurs when the Sparx5 driver is unbound or removed after PTP initialization returned early. Its cleanup path attempts to deinitialize uninitialized PTP transmit-SKB queues, causing a kernel NULL pointer dereference.
Is PTP required to be enabled for the issue to occur?
No. The affected condition is specifically that PTP was not used or was not initialized, but the driver removal path still performed PTP cleanup.
What is the available remediation?
Apply the kernel fix that makes sparx5_ptp_deinit() return early when PTP is not used. The provided references identify the corresponding stable-kernel commits.