CVE-2026-98795 net: sparx5: skip ptp deinit if init was skipped
Unbinding the Sparx5 network driver on specific LAN969x variants causes a kernel NULL pointer dereference, leading to a system crash.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98795?
CVE-2026-98795 is a vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: sparx5: skip ptp deinit if init was skipped
sparx5_ptp_init() returns early on the base lan969x variants because they do not have the SPX5_FEATURE_PTP flag. It also returns early when no "ptp" interrupt is described. Unbinding the driver then causes a NULL pointer dereference when cleaning up uninitialized tx_skbs queues:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 Call trace: skb_queue_purge_reason+0x68/0x120 (P) sparx5_ptp_deinit+0x64/0xc0 mchp_sparx5_remove+0x38/0x70 platform_remove+0x20/0x30 device_remove+0x4c/0x80
Before per-port tx_skbs were added, a NULL dereference would have happened when calling ptp_clock_unregister() on the never-registered PTP clocks.
Fix by returning early in sparx5_ptp_deinit() if PTP is not used.
Which versions are affected by CVE-2026-98795?
How do I fix CVE-2026-98795?
Apply the vendor's patch.
Is CVE-2026-98795 being exploited?
There is no known exploitation of CVE-2026-98795 in the wild and no public exploit code.
Sources
Also known as AZL-108662, BELL-CVE-2026-98795, DEBIAN-CVE-2026-98795, GHSA-9hv5-vqfc-jqjg, UBUNTU-CVE-2026-98795.