CVE-2026-99193

What it actually does

NULL pointer dereference during network device initialization when netdev_ops is read before assignment in the presence of CONFIG_NET_SHAPER.

Why it matters to the business

Systems using affected network hardware may crash during boot or driver probing, causing downtime on Linux-based network appliances and embedded devices.

How an attack unfolds

An attacker with local access or the ability to trigger device probing can cause the kernel to dereference a null netdev_ops pointer during PHY attachment in the icssm-prueth driver, leading to a crash.

How to fix it

Update to a Linux kernel containing the fix that assigns netdev_ops prior to PHY attachment; apply the equivalent change from commit 7c9f391ec89c to the icssm-prueth driver.

How to confirm the fix worked

Confirm the netdev_ops assignment occurs before of_phy_get_and_connect in the driver source; test device probing with CONFIG_NET_SHAPER enabled and verify no crash occurs.

Typical attack path

1. Trigger network device probe or module load on affected hardware
2. Kernel executes icssm_prueth_netdev_init and calls of_phy_get_and_connect before netdev_ops assignment
3. phy_attach_direct invokes netdev_need_ops_lock which reads the unset pointer under CONFIG_NET_SHAPER
4. NULL dereference occurs resulting in kernel panic

How to detect it

Review kernel logs for NULL pointer dereference panics originating from phy_attach_direct or netdev_need_ops_lock during device probe; correlate with icssm-prueth or TI PRU Ethernet initialization.

What your security team should do

• Prioritize kernel updates on systems exposing the icssm-prueth driver
• Monitor for kernel oops or panic logs during network initialization
• Disable CONFIG_NET_SHAPER temporarily if updates cannot be applied immediately