CVE-2026-80694 in Linux
Summary
by MITRE • 08/28/2026
In the Linux kernel, the following vulnerability has been resolved:
net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller
mtk_handle_irq_rx expects a struct mtk_eth * (matching the request_irq cookie), but mtk_poll_controller incorrectly passed the net_device *. Calling ndo_poll_controller with CONFIG_NET_POLL_CONTROLLER enabled would then crash.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/28/2026
The vulnerability identified within the Linux kernel network subsystem involves an incorrect parameter type being passed to a critical interrupt handling function in the MediaTek Ethernet driver. Specifically, the issue resides in the mtk_eth_soc driver where the poll controller implementation fails to adhere to the expected interface contract defined by the request_irq registration mechanism. The core technical flaw is that the mtk_poll_controller function invokes mtk_handle_irq_rx but supplies a pointer to struct net_device instead of the required struct mtk_eth structure. This mismatch occurs because the interrupt handler was registered with a cookie pointing to the driver's private hardware context data, yet the polling routine attempts to access this context using an incorrect object reference that represents the network interface rather than the underlying hardware device.
This type error leads directly to a kernel panic or system crash when the condition CONFIG_NET_POLL_CONTROLLER is enabled in the kernel configuration. The netpoll subsystem relies on poll_controller callbacks to allow networking functionality during early boot or after a kernel oops, ensuring that diagnostic tools can still transmit packets even if normal network operations are compromised. When mtk_handle_irq_rx receives an invalid pointer type, it attempts to dereference memory addresses based on the offset of struct members within struct mtk_eth but interprets them through the layout of struct net_device. Since these structures have different sizes and member offsets, this results in out-of-bounds memory access or corruption of critical kernel data structures, causing immediate instability and a denial of service for the system running the affected kernel version.
From a classification perspective, this vulnerability aligns with CWE-823 which covers use of incorrect object reference during pointer arithmetic or type casting errors that lead to security violations. In terms of attack vectors described by MITRE ATT&CK, while this is primarily an internal stability issue rather than an exploitable remote code execution flaw in typical scenarios, it falls under the category of Denial of Service via kernel crash mechanisms. An attacker with local access who can trigger network polling operations during specific system states could potentially induce a denial of service condition by exploiting this pointer mismatch to crash the host machine.
The operational impact is severe for systems relying on netpoll capabilities, such as those used in embedded environments or high-availability servers where remote debugging over the network is required after a failure. The immediate consequence is a complete system halt requiring a hard reset. Mitigation strategies involve applying the upstream kernel patch that corrects the function call signature within mtk_poll_controller to pass the correct struct mtk_eth pointer obtained from the net_device's private data field. Administrators should ensure their systems are updated with patched versions of the Linux kernel and specifically verify that the MediaTek Ethernet driver is compiled with corrected source code if custom kernels are in use. Regular patch management cycles are essential to address such low-level memory safety issues before they can be leveraged for disruptive effects.