CVE-2026-99197
Received Received - Intake

BaseFortify

Publication date: 2026-10-28

Last updated on: 2026-10-28

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: mv643xx: move setting of netops to fix crash mv643xx_eth_probe() connects the PHY before dev->netdev_ops is assigned. phy_attach_direct() -> phy_link_topo_add_phy() reads dev->netdev_ops through netdev_need_ops_lock() since the commit in question, so probing crashes with a NULL pointer dereference when CONFIG_NET_SHAPER is enabled. Assign netdev_ops before the PHY attach, as was done for emac in commit 7c9f391ec89c ("net: emac: move setting of netops to fix crash").

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-28
Last Modified
2026-10-28
Generated
2026-10-28
AI Q&A
2026-10-28
EPSS Evaluated
N/A
NVD
CVE-2026-99197
EUVD
EUVD-2026-111949

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
Linux Linux ded86da4bbb78cad74cecc368fee3ae3a296e2ca
Linux Linux ded86da4bbb78cad74cecc368fee3ae3a296e2ca
Linux Linux 7.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Linux kernel bug in the mv643xx Ethernet driver. It occurs during device probing when the PHY (physical layer interface) is connected before the network device operations are set. This causes a NULL pointer dereference crash when CONFIG_NET_SHAPER is enabled.

Detection Guidance

This vulnerability is specific to the Linux kernel's mv643xx Ethernet driver and may cause a crash during network interface probing. Detection requires checking kernel logs for crashes during network device initialization or verifying if CONFIG_NET_SHAPER is enabled in your kernel configuration.

Impact Analysis

If you use a system with the affected Linux kernel and CONFIG_NET_SHAPER enabled, this vulnerability could cause system crashes during network device initialization. This may lead to denial of service or require a reboot to recover.

Mitigation Strategies

Apply the kernel patch that moves the netdev_ops assignment before PHY attachment. Update to a kernel version containing the fix or backport the patch manually. Avoid using CONFIG_NET_SHAPER if possible until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-99197. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart