CVE-2026-98620

Received Received - Intake

Linux Kernel Network Device Registration Failure

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: unregister net_devices in case of probe failure If register_netdev() fails for one of the MTK_MAX_DEVS devices in mtk_probe(), the error path jumps to err_deinit_ppe, skipping mtk_unreg_dev(). The previously registered net_devices are then freed by mtk_free_dev() while still in NETREG_REGISTERED state, hitting the BUG_ON(dev->reg_state != NETREG_UNREGISTERED). Route the register_netdev() failure to err_unreg_netdev so the net_devices registered so far are properly unregistered before being freed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98620

EUVD

EUVD-2026-103665

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	8a8a9e89f801ce5d3d1d57ac48db678caf072147
Linux	Linux	8a8a9e89f801ce5d3d1d57ac48db678caf072147
Linux	Linux	8a8a9e89f801ce5d3d1d57ac48db678caf072147
Linux	Linux	8a8a9e89f801ce5d3d1d57ac48db678caf072147
Linux	Linux	8a8a9e89f801ce5d3d1d57ac48db678caf072147
Linux	Linux	4.9

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper cleanup during network device driver initialization. When the mtk_probe function fails to register a network device, it skips proper unregistration, leaving devices in an invalid state. This triggers a kernel bug check (BUG_ON) when the devices are later freed.

Detection Guidance

This vulnerability is specific to the Linux kernel's MediaTek ethernet driver (mtk_eth_soc). Detection requires checking kernel logs for probe failures in the mtk_eth_soc module or errors related to net_device registration during system boot or driver loading.

Impact Analysis

This vulnerability could cause system crashes or kernel panics if the affected network driver fails during initialization. Users might experience network connectivity issues or system instability when using devices with the MTK Ethernet driver.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel network driver issue causing system instability during device probe failures, not a data protection or privacy breach.

Mitigation Strategies

Apply the latest kernel update that includes the fix for this issue. If updating is not immediately possible, avoid using MediaTek ethernet devices until patched. Monitor kernel logs for errors during driver initialization.

Hi! I’m here to help you understand CVE-2026-98620. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70