Cloudanix VulnDB

CVE-2026-99195

None

CVSS

—

EPSS

0.1%

Published

Oct 28, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Linux kernel networking driver bug can crash the system during startup on certain network hardware.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

NULL pointer dereference occurs in netdev_need_ops_lock during phy_attach_direct when ethoc_mdio_probe runs before netdev_ops assignment in ethoc_probe under CONFIG_NET_SHAPER.

Why it matters to the business

Kernel panic or boot failure on systems using the ethoc Ethernet controller with affected kernel configurations, disrupting network-dependent operations.

How an attack unfolds

An attacker triggers device initialization or reprobe on a system running a vulnerable kernel with CONFIG_NET_SHAPER enabled, causing the PHY attach path to dereference an unset netdev_ops pointer and panic the kernel.

How to fix it

Apply the upstream fix that assigns netdev_ops before the PHY attach call in ethoc_probe, matching the pattern used for emac.

How to confirm the fix worked

Inspect ethoc.c to confirm netdev_ops assignment precedes ethoc_mdio_probe, and test device probe with CONFIG_NET_SHAPER enabled.

Typical attack path

  1. Obtain local or hardware-triggered access to initiate ethoc device probe
  2. Ensure CONFIG_NET_SHAPER is compiled in
  3. Allow ethoc_mdio_probe to call phy_attach_direct before netdev_ops is set
  4. Trigger netdev_need_ops_lock which reads the NULL pointer

How to detect it

Search kernel logs and crash dumps for ethoc_probe entries combined with NULL pointer dereference in netdev_need_ops_lock or phy_link_topo_add_phy.

  • ethoc_probe
  • netdev_need_ops_lock
  • phy_attach_direct
  • NULL pointer dereference in ethoc

What your security team should do

  • Update to a kernel containing the ethoc netops ordering fix
  • Monitor kernel oops logs for ethoc-related NULL dereferences
  • Consider disabling CONFIG_NET_SHAPER on embedded systems using ethoc until patched

The record

In the Linux kernel, the following vulnerability has been resolved: net: ethoc: move setting of netops to fix crash ethoc_probe() calls ethoc_mdio_probe(), which connects the PHY, before netdev->netdev_ops is assigned. phy_attach_direct() -> phy_link_topo_add_phy() reads dev->netdev_ops through netdev_need_ops_lock() since the commit in question, so probing crashes with a NULL pointer dereference when CONFIG_NET_SHAPER is enabled. Assign netdev_ops before the PHY attach, as was done for emac in commit 7c9f391ec89c ("net: emac: move setting of netops to fix crash").

Affected packages

Ecosystem Package Introduced Fixed