Cloudanix VulnDB

CVE-2026-80694

Critical · 9.8

CVSS

9.8

EPSS

0.5%

Published

Aug 28, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A Linux kernel network driver bug can cause certain network hardware to crash the whole system when a specific debugging feature is turned on.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Incorrect pointer type passed to mtk_handle_irq_rx (net_device * instead of expected struct mtk_eth *), resulting in invalid memory dereference and crash when ndo_poll_controller is invoked under CONFIG_NET_POLL_CONTROLLER.

Why it matters to the business

Kernel-level denial of service on affected Ethernet devices, interrupting network connectivity and requiring system reboot or recovery.

How an attack unfolds

An attacker triggers the network poll controller path on a system with the vulnerable driver and CONFIG_NET_POLL_CONTROLLER enabled, causing the mismatched pointer to be used and crashing the kernel.

How to fix it

Apply the upstream kernel patch that correctly passes the struct mtk_eth pointer from mtk_poll_controller; rebuild and deploy updated kernel images.

How to confirm the fix worked

Inspect driver source for correct mtk_eth pointer passing in mtk_poll_controller; enable CONFIG_NET_POLL_CONTROLLER and exercise ndo_poll_controller without crash.

Typical attack path

  1. Confirm target runs vulnerable mtk_eth_soc driver with CONFIG_NET_POLL_CONTROLLER
  2. Invoke ndo_poll_controller through network interface activity
  3. Trigger type mismatch and kernel panic

How to detect it

Review kernel logs and panic traces for references to mtk_handle_irq_rx or mtk_poll_controller pointer mismatches.

What your security team should do

  • Prioritize kernel updates for systems using MediaTek Ethernet
  • Disable CONFIG_NET_POLL_CONTROLLER where poll controller support is unnecessary
  • Include mtk_eth_soc crash signatures in kernel monitoring

The record

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller mtk_handle_irq_rx expects a struct mtk_eth * (matching the request_irq cookie), but mtk_poll_controller incorrectly passed the net_device *. Calling ndo_poll_controller with CONFIG_NET_POLL_CONTROLLER enabled would then crash.

Affected packages

Ecosystem Package Introduced Fixed