CVE-2026-98795: Linux vulnerability

CVE-2026-98795: net: sparx5: skip ptp deinit if init was skipped

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: skip ptp deinit if init was skipped sparx5_ptp_init() returns early on the base lan969x variants because they do not have the SPX5_FEATURE_PTP flag. It also returns early when no "ptp" interrupt is described. Unbinding the driver then causes a NULL pointer dereference when cleaning up uninitialized tx_skbs queues: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 Call trace: skb_queue_purge_reason+0x68/0x120 (P) sparx5_ptp_deinit+0x64/0xc0 mchp_sparx5_remove+0x38/0x70 platform_remove+0x20/0x30 device_remove+0x4c/0x80 Before per-port tx_skbs were added, a NULL dereference would have happened when calling ptp_clock_unregister() on the never-registered PTP clocks. Fix by returning early in sparx5_ptp_deinit() if PTP is not used.

UnknownCVSS not scoredNot KEV-listedUpdatedOct 18, 2026, 15:48 UTC (UTC+00:00)

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-98795 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup

Vulnerability profileCVE Program record

Severity: Unknown
CVSS: Not scored
Known Exploited: No
Published: Oct 18, 2026, 15:48 UTC (UTC+00:00)

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors

3Timeline events

0ADP providers

4Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
Sep 25, 2026, 10:25 UTC (UTC+00:00)
CVE publishedCVE Program
The CVE record was published.
Oct 18, 2026, 15:48 UTC (UTC+00:00)
CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Oct 18, 2026, 15:48 UTC (UTC+00:00)

Source materials

CVE List V5 sourceCVE List V5
https://git.kernel.org/stable/c/35c706d6eb1963735814c5f5bb2674a96eacf3ccCVE reference, Linux
https://git.kernel.org/stable/c/2879b65bfa548e10d59c5fba91d17f8a00cd7029CVE reference, Linux
https://git.kernel.org/stable/c/0d2c49915bc3aea4521cda5e4d42f24f63b94585CVE reference, Linux

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus

LinuxLinux0933bd04047c3b96ba49545a8f91e7e6f8f666ff, 0933bd04047c3b96ba49545a8f91e7e6f8f666ff, 0933bd04047c3b96ba49545a8f91e7e6f8f666ffunaffected

LinuxLinux5.18, 0, 6.18.56, 7.2.10, 7.3-rc6affected

Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.