Cloudanix VulnDB

CVE-2026-98922

None

CVSS

—

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A startup problem in certain network hardware drivers could crash the whole system on boot, and the fix ensures the driver finishes setting itself up before trying to talk to the network chip.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Null pointer dereference during EMAC driver probe when of_phy_connect is called before netdev_ops are initialized, triggered by phy_link_topo_add_phy netdev_need_ops_lock check added in recent ethtool changes.

Why it matters to the business

Kernel panic on boot prevents affected embedded PowerPC network devices from starting, causing downtime on systems using this driver until patched kernel is deployed.

How an attack unfolds

An attacker with ability to trigger driver initialization on vulnerable hardware (such as during boot or module load) causes the kernel to dereference an uninitialized pointer, leading to immediate crash; no remote code execution path exists.

How to fix it

Update to a kernel containing the fix that moves netdev_ops, commac.ops, and ethtool_ops assignment earlier in emac_init_config based on device-tree, ensuring the non-gige commac.ops assignment occurs in the correct conditional block.

How to confirm the fix worked

Confirm the patch is present by inspecting emac_probe and emac_init_config ordering, then boot on affected hardware and verify no NULL dereference occurs during platform_probe of the EMAC device.

Typical attack path

  1. Obtain local or physical access to trigger boot or insmod of emac driver on PowerPC 44x platform
  2. Driver calls of_phy_connect before netdev_ops assignment
  3. phy_link_topo_add_phy performs netdev_need_ops_lock check on NULL pointer
  4. Kernel oops and panic

How to detect it

Review kernel logs for BUG: Kernel NULL pointer dereference mentioning phy_link_topo_add_phy during emac_probe or platform_probe on PowerPC systems; no persistent artifacts remain after reboot.

What your security team should do

  • Apply the fix immediately on any PowerPC 44x systems using the emac driver
  • Prioritize testing on WD MyBook Live and similar RGMII hardware
  • Monitor for similar ordering issues in other network drivers after recent ethtool locking changes

The record

In the Linux kernel, the following vulnerability has been resolved: net: emac: move setting of netops to fix crash fixes the following crash on driver initialization: |BUG: Kernel NULL pointer dereference on read at 0x00000158 |Faulting instruction address: 0xc0566b40 |Oops: Kernel access of bad area, sig: 11 [#1] |BE PAGE_SIZE=4K PowerPC 44x Platform |Modules linked in: |CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Tainted: GW 7.3.0-rc3+ #1 |Tainted: [W]=WARN |Hardware name: MyBook Live APM821XX 0x12c41c83 PowerPC 44x Platform |NIP: c0566b40 LR: c05648f8 CTR: c04c1e9c |REGS: c1053a20 TRAP: 0300 Tainted: GW (7.3.0-rc3+) |MSR: 0002b000 <CE,EE,FP,ME> CR: 24008808 XER: 00000000 |DEAR: 00000158 ESR: 00000000 |GPR00: c05648f8 c1053b10 c1063600 c1030000 c5ab3000 00000000 [...] |GPR08: 00000002 00000000 00000000 c1053b40 84002808 00000000 [...] |GPR16: cfffd210 00000002 c0beafcc cfffc960 00000000 c1030644 [...] |GPR24: c0beafbc c1037000 00000000 0000000a 00000000 c1030000 [...] |NIP [c0566b40] phy_link_topo_add_phy+0x2c/0x1d0 |LR [c05648f8] phy_attach_direct+0x1a4/0x368 |Call Trace: |[c1053b10] [c0811e04] klist_put+0x54/0xb4 (unreliable) |[c1053b40] [c05648f8] phy_attach_direct+0x1a4/0x368 |[c1053b70] [c0564ae8] phy_connect_direct+0x2c/0x60 |[c1053b90] [c056c7a8] of_phy_connect+0x50/0x74 |[c1053bc0] [c0572a88] emac_probe+0xd50/0x119c |[c1053c90] [c04cb770] platform_probe+0x74/0xa4 |[c1053cb0] [c04c8f08] really_probe+0x120/0x2b0 |[c1053cd0] [c04c9254] __driver_probe_device+0x1bc/0x1fc |[c1053d00] [c04c9334] driver_probe_device+0x38/0xa8 |[c1053d30] [c04c9560] __driver_attach+0xf4/0x10c |[c1053d50] [c04c6af8] bus_for_each_dev+0x68/0xd0 |[c1053d90] [c04c7c34] bus_add_driver+0xcc/0x1ec |[c1053dc0] [c04c9f6c] driver_register+0xcc/0x110 |[c1053de0] [c0aa3f40] emac_init+0x1c4/0x200 This bug showed up starting with v7.3-rc1. At the NIP in phy_link_topo_add_phy() is a netdev_need_ops_lock() check. This was added by the following commit ded86da4bbb7 ("net: ethtool: relax ethnl_req_get_phydev() locking assertion") The bug shows up because at the time of_phy_connect() was called, the netdev_ops were *not yet* determined. My fix is to move the code that sets netdev_ops+commac.ops+ethtool_ops further up as emac_init_config() derives that by looking at the device-tree and sets the required dev->phy_mode accordingly. During review, the Sashiko bot's AI stated that the commac assignment became a dead store. Great catch! To keep the original behavior as-is, one mentioned option "set dev->commac.ops = &emac_commac_ops only in the non-gige case?" sounded like a great plan. So the dev->commac.ops assignment for the non-gige-case moves into the else block. This patch was tested on a WD MyBook Live (RGMII). the device now works again.

Affected packages

Ecosystem Package Introduced Fixed