Cloudanix VulnDB

CVE-2026-99196

None

CVSS

—

EPSS

0.2%

Published

Oct 28, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A startup bug in certain network hardware drivers can make the whole computer crash if an optional feature is turned on.

Exploitation
Other
Attacker needs
Local User
Complexity
Theoretical
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

NULL pointer dereference in au1000 network driver probe when netdev_ops is read before assignment under CONFIG_NET_SHAPER, triggered during PHY attachment.

Why it matters to the business

Systems using affected au1000 hardware may crash on boot or driver initialization, causing downtime and requiring manual intervention to recover.

How an attack unfolds

An attacker with local access or the ability to trigger hardware probe on a vulnerable kernel configuration causes the driver to dereference a null pointer during initialization, resulting in a kernel panic.

How to fix it

Update the Linux kernel to a version containing the fix that assigns netdev_ops before PHY probe, as referenced in the au1000 and emac commits.

How to confirm the fix worked

Confirm netdev_ops assignment occurs prior to au1000_mii_probe in the driver source; test boot with CONFIG_NET_SHAPER enabled on au1000 hardware.

Typical attack path

  1. Gain local access or control boot parameters on target system
  2. Ensure CONFIG_NET_SHAPER is enabled in kernel config
  3. Trigger au1000 device probe via module load or system boot
  4. phy_attach_direct reads uninitialized netdev_ops leading to crash

How to detect it

Review kernel logs and dmesg for NULL pointer dereference panics during au1000_probe or phy_attach_direct on systems with the driver present.

What your security team should do

  • Prioritize kernel updates for systems with au1000 network devices
  • Disable CONFIG_NET_SHAPER if immediate patching is not feasible
  • Monitor kernel logs for NULL pointer dereferences during network driver initialization

The record

In the Linux kernel, the following vulnerability has been resolved: net: au1000: move setting of netops to fix crash au1000_probe() calls au1000_mii_probe(), which connects the PHY, before dev->netdev_ops is assigned. phy_attach_direct() -> phy_link_topo_add_phy() reads dev->netdev_ops through netdev_need_ops_lock() since the commit in question, so probing crashes with a NULL pointer dereference when CONFIG_NET_SHAPER is enabled. Assign netdev_ops before the PHY attach, as was done for emac in commit 7c9f391ec89c ("net: emac: move setting of netops to fix crash").

Affected packages

Ecosystem Package Introduced Fixed