Cloudanix VulnDB

CVE-2026-99197

None

CVSS

—

EPSS

0.1%

Published

Oct 28, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A driver ordering mistake can make certain network cards cause the whole computer to crash right when it starts up.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

NULL pointer dereference during mv643xx Ethernet driver probe when CONFIG_NET_SHAPER is enabled, because netdev_ops is read before assignment in phy_attach_direct path.

Why it matters to the business

Systems using affected network hardware may crash at boot or module load, causing downtime and requiring manual intervention to disable the driver or kernel option.

How an attack unfolds

An attacker with local access triggers driver probe (via module load or interface bring-up) on a kernel built with CONFIG_NET_SHAPER; the missing netdev_ops assignment leads to the dereference and crash before any network operations occur.

How to fix it

Update to a kernel containing the referenced fix that moves netdev_ops assignment before PHY attach; rebuild with the corrected driver ordering or disable the shaper config if hardware is not required.

How to confirm the fix worked

Confirm netdev_ops pointer is non-NULL before phy_attach_direct in the probe function; test module load on a CONFIG_NET_SHAPER-enabled kernel and verify absence of panic.

Typical attack path

  1. Obtain local access to target system
  2. Load or trigger mv643xx_eth module initialization
  3. Ensure CONFIG_NET_SHAPER is compiled in
  4. Observe NULL dereference and kernel panic during phy_attach

How to detect it

Search kernel logs and dmesg for mv643xx_eth_probe NULL pointer dereference messages or oops involving netdev_need_ops_lock and phy_link_topo_add_phy.

  • mv643xx_eth_probe
  • phy_attach_direct
  • netdev_need_ops_lock
  • NULL pointer dereference

What your security team should do

  • Apply upstream kernel patch immediately on affected hardware
  • Audit boot logs for related oops on systems with mv643xx
  • Consider disabling CONFIG_NET_SHAPER where not needed until patched

The record

In the Linux kernel, the following vulnerability has been resolved: net: mv643xx: move setting of netops to fix crash mv643xx_eth_probe() connects the PHY before dev->netdev_ops is assigned. phy_attach_direct() -> phy_link_topo_add_phy() reads dev->netdev_ops through netdev_need_ops_lock() since the commit in question, so probing crashes with a NULL pointer dereference when CONFIG_NET_SHAPER is enabled. Assign netdev_ops before the PHY attach, as was done for emac in commit 7c9f391ec89c ("net: emac: move setting of netops to fix crash").

Affected packages

Ecosystem Package Introduced Fixed