Cloudanix VulnDB

CVE-2026-99198

None

CVSS

—

EPSS

0.2%

Published

Oct 28, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A setup error in the Linux kernel for certain network hardware can cause the whole system to crash when starting up.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Null pointer dereference occurs in owl_emac_probe because netdev->netdev_ops is read via netdev_need_ops_lock inside phy_attach_direct before assignment when CONFIG_NET_SHAPER is enabled.

Why it matters to the business

Systems using the affected Actions Semiconductor Ethernet controller experience kernel panics during boot or driver initialization, causing denial of service and potential downtime on hardware with the driver present.

How an attack unfolds

An attacker with local access or the ability to trigger hardware detection loads the owl_emac module or ensures the PHY is attached during probe on a kernel built with CONFIG_NET_SHAPER, resulting in immediate NULL dereference and crash.

How to fix it

Apply the upstream kernel fix that assigns netdev_ops before calling owl_emac_phy_init in drivers/net/ethernet/actions/owl-emac.c, matching the approach used for similar emac drivers.

How to confirm the fix worked

Inspect the probe function ordering in the source tree after update, confirm netdev_ops is set prior to phy_attach_direct, and test device initialization on affected hardware without panic.

Typical attack path

  1. Build or use a kernel with CONFIG_NET_SHAPER enabled
  2. Ensure the owl_emac driver is present and probed
  3. Trigger owl_emac_probe which calls owl_emac_phy_init before netdev_ops assignment
  4. phy_link_topo_add_phy reads uninitialized netdev_ops causing panic

How to detect it

Search kernel logs and dmesg for NULL pointer dereference or oops mentioning owl_emac_probe, phy_attach_direct, or netdev_need_ops_lock around boot or module load time.

  • owl_emac_probe
  • netdev_need_ops_lock
  • phy_attach_direct
  • NULL pointer dereference in net: ethernet: actions

What your security team should do

  • Update to a kernel containing the fix as soon as available
  • Review boot logs for related oops on systems using the driver
  • Consider disabling CONFIG_NET_SHAPER on non-essential builds until patched

The record

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: actions: Move setting of netops to fix crash owl_emac_probe() calls owl_emac_phy_init(), which connects the PHY, before netdev->netdev_ops is assigned. phy_attach_direct() -> phy_link_topo_add_phy() reads dev->netdev_ops through netdev_need_ops_lock() since the commit in question, so probing crashes with a NULL pointer dereference when CONFIG_NET_SHAPER is enabled. Assign netdev_ops before the PHY attach, as was done for emac in commit 7c9f391ec89c ("net: emac: move setting of netops to fix crash").

Affected packages

Ecosystem Package Introduced Fixed