Cloudanix VulnDB

CVE-2026-99194

None

CVSS

—

EPSS

0.1%

Published

Oct 28, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A recently fixed bug could cause certain network cards to crash the whole computer when the system starts up.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

NULL pointer dereference during greth_of_probe() when greth_mdio_init() triggers phy_attach_direct() before dev->netdev_ops is assigned, under CONFIG_NET_SHAPER.

Why it matters to the business

Kernel crash on boot or module load for affected ethernet hardware causes system downtime and prevents network initialization until patched.

How an attack unfolds

An attacker with local access or the ability to trigger driver probe on vulnerable hardware can induce the NULL dereference by loading the aeroflex greth driver when the shaper config option is enabled, reproducing the crash path introduced by the referenced netdev_ops read.

How to fix it

Apply the upstream kernel commit that assigns netdev_ops before the PHY attach call; rebuild and deploy the fixed kernel on affected systems.

How to confirm the fix worked

Confirm netdev_ops assignment occurs prior to greth_mdio_init() in the driver probe sequence; test probe on hardware with CONFIG_NET_SHAPER enabled and verify no crash.

Typical attack path

  1. Gain local execution or physical access to target system
  2. Ensure CONFIG_NET_SHAPER is enabled in kernel config
  3. Load or probe the greth aeroflex ethernet driver
  4. Trigger greth_of_probe() -> greth_mdio_init() -> phy_attach_direct() before netdev_ops assignment
  5. Cause NULL pointer dereference and kernel panic

How to detect it

Inspect kernel logs and dmesg for NULL pointer dereference during greth probe or phy_attach; look for crashes shortly after driver initialization on systems with aeroflex hardware.

What your security team should do

  • Prioritize kernel update on any systems using aeroflex greth ethernet hardware
  • Review kernel configs for CONFIG_NET_SHAPER and assess exposure
  • Monitor for related driver probe failures in system logs
  • Test patched kernels in staging before production rollout given recent publication

The record

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: aeroflex: move setting of netops to fix crash greth_of_probe() calls greth_mdio_init(), which connects the PHY, before dev->netdev_ops is assigned. phy_attach_direct() -> phy_link_topo_add_phy() reads dev->netdev_ops through netdev_need_ops_lock() since the commit in question, so probing crashes with a NULL pointer dereference when CONFIG_NET_SHAPER is enabled. Assign netdev_ops before the PHY attach, as was done for emac in commit 7c9f391ec89c ("net: emac: move setting of netops to fix crash").

Affected packages

Ecosystem Package Introduced Fixed