CVE-2026-99200
Received Received - Intake

BaseFortify

Publication date: 2026-10-28

Last updated on: 2026-10-28

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: hisilicon: hisi_femac: Move setting of netops to fix crash hisi_femac_drv_probe() connects the PHY before dev->netdev_ops is assigned. phy_attach_direct() -> phy_link_topo_add_phy() reads dev->netdev_ops through netdev_need_ops_lock() since the commit in question, so probing crashes with a NULL pointer dereference when CONFIG_NET_SHAPER is enabled. phy_link_topo_add_phy from phy_attach_direct+0xec/0x37c of_phy_get_and_connect from hisi_femac_drv_probe+0x1f4/0x558 Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b Assign netdev_ops before the PHY attach, as was done for emac in commit 7c9f391ec89c ("net: emac: move setting of netops to fix crash").

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-28
Last Modified
2026-10-28
Generated
2026-10-28
AI Q&A
2026-10-28
EPSS Evaluated
N/A
NVD
CVE-2026-99200
EUVD
EUVD-2026-111952

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
Linux Linux ded86da4bbb78cad74cecc368fee3ae3a296e2ca
Linux Linux ded86da4bbb78cad74cecc368fee3ae3a296e2ca
Linux Linux 7.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a crash during device probing in the Hisilicon FEMAC network driver. The issue occurs because the PHY (Physical Layer) is connected before the network device operations are set, leading to a NULL pointer dereference when CONFIG_NET_SHAPER is enabled. This causes a kernel panic and system failure.

Detection Guidance

This vulnerability is specific to the Linux kernel's hisi_femac driver and may cause a kernel panic during network interface initialization. Detection requires checking kernel logs for crashes during driver probe or PHY attachment. Examine logs with dmesg or journalctl for errors related to hisi_femac or PHY operations.

Impact Analysis

This vulnerability can cause system crashes during boot or device initialization, leading to unavailability of network functionality. It may result in kernel panics, preventing the system from starting properly or disrupting network operations.

Mitigation Strategies

Update the Linux kernel to a patched version where the hisi_femac driver assigns netdev_ops before PHY attachment. Avoid using CONFIG_NET_SHAPER if possible. Monitor kernel updates from your distribution for a fix.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-99200. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart