CVE-2026-98302 in Linux
Summary
by MITRE • 10/06/2026
In the Linux kernel, the following vulnerability has been resolved:
net: fddi: skfp: fix NULL deref when setting the MAC address while down
skfp_ctl_set_mac_address() calls ResetAdapter() unconditionally, without checking netif_running(). ResetAdapter() first calls card_stop(), which sets smc->hw.hw_state to STOPPED, and then mac_drv_clear_tx_queue(), which walks the two transmit queues:
for (i = QUEUE_S; i <= QUEUE_A0; i++) {
queue = smc->hw.fp.tx[i] ;
... t = queue->tx_curr_get ;
smc->hw.fp.tx[] is only populated by init_tx(), which is reached from
skfp_open() through init_smt() -> init_fddi_driver() -> init_fplus() -> init_mac() -> init_tx(). The private area is allocated and zeroed by alloc_fddidev(), so on an interface that has never been brought up both queue pointers are still NULL. The hw_state test at the top of mac_drv_clear_tx_queue() does not catch this, because card_stop() has just set STOPPED; the function proceeds into the loop and dereferences NULL. ResetAdapter() does call init_smt() itself, but only after the queues have been cleared.
Setting the MAC address on a down interface therefore oopses:
ip link set dev fddi0 address 02:00:00:00:00:01
BUG: KASAN: null-ptr-deref in mac_drv_clear_tx_queue+0x68/0x2c0 [skfp]
Read of size 8 at addr 0000000000000010 by task ip/302 Call Trace: <TASK> mac_drv_clear_tx_queue+0x68/0x2c0 [skfp 6c01d4bab63c36978bd0a7d7e90837adb44cc37b]
ResetAdapter+0x29/0x100 [skfp 6c01d4bab63c36978bd0a7d7e90837adb44cc37b]
skfp_ctl_set_mac_address+0x57/0x80 [skfp 6c01d4bab63c36978bd0a7d7e90837adb44cc37b]
netif_set_mac_address+0x1e4/0x2c0 do_setlink+0x684/0x2680 </TASK>
Address 0x10 is the offset of tx_curr_get, the third pointer in struct s_smt_tx_queue, on 64-bit. mac_drv_clear_rx_queue(), which ResetAdapter() calls immediately afterwards, dereferences smc->hw.fp.rx[QUEUE_R1] in the same way behind the same ineffective
hw_state test; the transmit queue merely crashes first. Both are covered by the guard below.
Skip the adapter reset when the interface is down. dev_addr_set() is left unconditional, so the new address is still recorded in dev->dev_addr. Nothing is lost by not resetting the adapter here: skfp_open() deliberately re-reads the factory address on every open,
read_address(smc, NULL); eth_hw_addr_set(dev, smc->hw.fddi_canon_addr.a);
and the comment above it states this is done to discard exactly such an address override across a close/open cycle. An address set while the interface is down could not have survived the following open even before this change, so the guard removes no working behaviour. Guarding the hardware side of ndo_set_mac_address() with netif_running() is established practice; skge_set_mac_address() has done so since commit 2eb3e621c4e0 ("skge: set mac address bonding fix").
Guarding the reset as a whole, rather than NULL-checking the queues, is also what the rest of the driver expects. After a previous open/close the queue pointers are stale but non-NULL, so there is no crash, yet ResetAdapter() goes on to call smt_online() and STI_FBI() ("Enable Board Interrupts") while skfp_close() has already called free_irq() - the adapter would be brought back online with no handler installed. The only other ResetAdapter() caller is skfp_interrupt(), which by construction runs only while the device is open.
Found by automated driver testing against an emulated SysKonnect FDDI adapter under a KASAN-enabled 7.0.0 kernel. Triggering it requires CAP_NET_ADMIN.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/06/2026
The Linux kernel vulnerability identified in the skfp network driver represents a critical NULL pointer dereference that occurs when attempting to modify the Media Access Control address of an FDDI interface while the device is in a down state. This flaw stems from improper handling of hardware initialization states within the skfp_ctl_set_mac_address function, which unconditionally invokes ResetAdapter regardless of whether the network interface is currently active or inactive. The operational sequence begins when a user with CAP_NET_ADMIN privileges executes an ip link command to set a new MAC address on a stopped interface. This triggers the driver's net device operation for setting addresses, leading directly into skfp_ctl_set_mac_address and subsequently ResetAdapter.
The core technical failure lies in the execution flow of ResetAdapter, which first calls card_stop followed by mac_drv_clear_tx_queue. The card_stop function updates the hardware state to STOPPED, but this check is insufficient because it does not verify if the driver has ever been initialized through a successful open operation. Specifically, the transmit and receive queue pointers within the skfp private data structure are allocated and zeroed during alloc_fddidev but only populated with valid memory addresses via init_tx when skfp_open is called. Consequently, on an interface that has never been brought up or was previously closed without proper re-initialization of these specific structures, the queue pointers remain NULL. When mac_drv_clear_tx_queue attempts to iterate over these queues and access members such as tx_curr_get, it dereferences a NULL pointer, resulting in a kernel panic or crash detected by Kernel Address Sanitizer during testing.
This vulnerability is further compounded because ResetAdapter also invokes mac_drv_clear_rx_queue immediately after clearing the transmit queue. This function performs an identical operation on the receive queues and would similarly trigger a null-pointer dereference if the interface has not been properly initialized. The existing guard within these functions, which checks for the STOPPED hardware state, fails to prevent execution because card_stop explicitly sets this state before the queue-clearing logic runs. Therefore, the protection mechanism is logically flawed as it allows access to uninitialized data structures that have not yet received valid memory allocations from the driver's open routine.
The impact of this vulnerability includes a denial of service against the local system due to kernel oops and potential instability if triggered in specific contexts. While exploitation requires CAP_NET_ADMIN privileges, which limits remote attack vectors, it poses a significant risk for local privilege escalation scenarios or stability issues within managed network environments where automated configuration tools might manipulate interface states without ensuring proper driver lifecycle management. The vulnerability aligns with CWE-476, NULL Pointer Dereference, and reflects poor state validation practices common in older kernel drivers that do not strictly enforce initialization sequences before accessing hardware-specific resources.
The remediation strategy involves guarding the ResetAdapter call within skfp_ctl_set_mac_address by checking if the network interface is currently running using netif_running(). This approach ensures that hardware reset operations are only performed when the driver has fully initialized its internal data structures, including transmit and receive queues. By skipping the adapter reset for down interfaces, the system avoids accessing uninitialized memory while still allowing the MAC address to be updated in the software representation via dev_addr_set. This change aligns with established best practices observed in other network drivers such as skge, where hardware modifications are deferred until the device is active and ready to handle interrupts and data processing.
Furthermore, this fix preserves intended driver behavior by acknowledging that setting a MAC address on a down interface does not persist across open cycles anyway due to existing logic that re-reads factory addresses upon opening. Thus, skipping the reset introduces no functional regression while eliminating the crash vector. The solution also prevents potential issues where stale queue pointers might lead to incorrect interrupt handling or memory corruption if ResetAdapter were allowed to proceed with partially initialized structures after a previous close operation. This case highlights the importance of rigorous state management in kernel network drivers and underscores the value of automated testing frameworks like KASAN in identifying subtle initialization flaws that could otherwise remain dormant until triggered by specific administrative actions.