Cloudanix VulnDB

CVE-2026-99199

None

CVSS

—

EPSS

0.1%

Published

Oct 28, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A driver bug can make certain Linux systems crash during startup when a specific networking feature is active.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Theoretical
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Null pointer dereference during network driver probe when CONFIG_NET_SHAPER is enabled, because of_phy_connect is called before ndev->netdev_ops is assigned, causing phy_attach_direct to read through a NULL pointer via netdev_need_ops_lock.

Why it matters to the business

System crashes on boot or driver load for affected hardware, producing unplanned downtime and requiring manual recovery on Linux systems using the hip04_eth driver.

How an attack unfolds

An attacker with local access or the ability to influence system boot can load or probe the vulnerable hip04_eth driver on a kernel compiled with CONFIG_NET_SHAPER; the probe sequence triggers the NULL dereference and kernel panic. No remote or unauthenticated exploitation path is known.

How to fix it

Apply the upstream fix that moves netdev_ops assignment before the PHY connect call, as done for the emac driver. Rebuild and deploy a patched Linux kernel containing commit 7c9f391ec89c equivalent changes for hip04_eth.

How to confirm the fix worked

Inspect hip04_mac_probe source to confirm netdev_ops is set prior to of_phy_connect; boot a test kernel with CONFIG_NET_SHAPER enabled and verify the driver loads without panic.

Typical attack path

  1. Obtain local execution or control over boot sequence on target system
  2. Ensure CONFIG_NET_SHAPER is enabled in the running kernel
  3. Trigger hip04_mac_probe via device discovery or manual module load
  4. of_phy_connect executes before netdev_ops assignment
  5. phy_link_topo_add_phy reads NULL netdev_ops and crashes the kernel

How to detect it

Search kernel logs and dmesg for oops or panic entries referencing hip04_eth, hip04_mac_probe, netdev_need_ops_lock, or phy_link_topo_add_phy during early boot; correlate with systems having CONFIG_NET_SHAPER enabled.

  • hip04_mac_probe
  • netdev_need_ops_lock
  • phy_link_topo_add_phy
  • NULL pointer dereference in hip04_eth

What your security team should do

  • Apply the kernel patch immediately on systems using hip04_eth hardware
  • Add kernel oops monitoring for hip04_eth NULL dereference signatures
  • Test patched kernels in staging before production rollout
  • Review CONFIG_NET_SHAPER usage and disable if not required

The record

In the Linux kernel, the following vulnerability has been resolved: net: hisilicon: hip04_eth: Move setting of netops to fix crash hip04_mac_probe() calls of_phy_connect() before ndev->netdev_ops is assigned. phy_attach_direct() -> phy_link_topo_add_phy() reads dev->netdev_ops through netdev_need_ops_lock() since the commit in question, so probing crashes with a NULL pointer dereference when CONFIG_NET_SHAPER is enabled. Assign netdev_ops before the PHY attach, as was done for emac in commit 7c9f391ec89c ("net: emac: move setting of netops to fix crash").

Affected packages

Ecosystem Package Introduced Fixed