Reference Leak Vulnerability in Linux Kernel's PTP Device by Cavium

CVE-2026-98913

What is CVE-2026-98913?

In the Linux kernel, a vulnerability exists within the ThunderX PTP device driver, specifically in the initialization sequence of the nicvf_probe() function. Here, the cavium_ptp_get() function acquires a reference to a PTP PCI device using pci_get_device(). If an error occurs during the subsequent initialization steps, this reference may remain held, leading to a reference leak. This issue is addressed by implementing a reliable error handling pathway that ensures the PTP device reference is properly released before any return from probe operation failures.

References