CVE-2026-98620 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
net: ethernet: mtk_eth_soc: unregister net_devices in case of probe failure
If register_netdev() fails for one of the MTK_MAX_DEVS devices in mtk_probe(), the error path jumps to err_deinit_ppe, skipping mtk_unreg_dev(). The previously registered net_devices are then freed by mtk_free_dev() while still in NETREG_REGISTERED state, hitting the BUG_ON(dev->reg_state != NETREG_UNREGISTERED).
Route the register_netdev() failure to err_unreg_netdev so the net_devices registered so far are properly unregistered before being freed.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/19/2026
The Linux kernel network subsystem enforces strict lifecycle management for network devices, requiring that a device be fully unregistered from the system before its memory is deallocated. This requirement ensures that all references to the device structure are released and that any pending operations or callbacks associated with the interface are properly terminated. In the MediaTek Ethernet SoC driver, specifically within the mtk_probe function responsible for initializing network interfaces during hardware detection, a critical error handling flaw was identified. The vulnerability arises when register_netdev fails for one of the multiple devices managed by the driver, which is defined by MTK_MAX_DEVS. Under normal operation, if registration succeeds, the device enters an active state; however, upon failure, the kernel expects any previously registered interfaces to be reverted to a clean slate before cleanup proceeds.
The technical flaw lies in the error path logic of mtk_probe. When register_netdev returns an error code for a specific network device, the original implementation incorrectly jumped directly to err_deinit_ppe. This label handles the deinitialization of Packet Processing Engine resources but completely bypasses the necessary call to mtk_unreg_dev(). Consequently, any net_devices that had been successfully registered prior to the failing attempt remained in the NETREG_REGISTERED state. The subsequent execution flow then invoked mtk_free_dev() to release the memory associated with these devices. Because the devices were still marked as registered within the kernel's internal tracking structures, this premature deallocation triggered a BUG_ON assertion checking that dev->reg_state equals NETREG_UNREGISTERED. This results in an immediate kernel panic or crash, effectively causing a denial of service condition for the entire system hosting the vulnerable driver instance.
From a security and stability perspective, this vulnerability represents a classic use-after-free scenario combined with improper state management. Although it does not directly allow arbitrary code execution due to the protective BUG_ON check which halts execution rather than allowing corrupted memory access, it severely impacts system availability. An attacker or even an automated testing tool could potentially trigger this condition by causing register_netdev to fail repeatedly during device initialization, such as through resource exhaustion or specific hardware configuration scenarios that provoke registration errors. The impact is a complete loss of system stability, requiring a reboot to restore service. This aligns with CWE-672, which describes the use of operations after they become invalid, and specifically relates to improper cleanup procedures in driver code. In terms of MITRE ATT&CK, this could be categorized under T1499 Endpoint Denial of Service if exploited intentionally to crash a target system, although it is more commonly observed as an unintentional stability issue during hardware probing or module loading phases.
The resolution involves correcting the control flow within mtk_probe to ensure that all previously registered network devices are properly unregistered before any memory freeing occurs. By routing the error path for register_netdev failures to err_unreg_netdev, the driver now correctly iterates through and calls unregister_netdevice on each device that was successfully added prior to the failure. This ensures that the kernel's internal state is consistent with the actual lifecycle of the objects being destroyed. To mitigate this vulnerability in environments where patching may not be immediately feasible, administrators should ensure that the MediaTek Ethernet driver modules are loaded only when necessary and monitor system logs for probe failures during hardware initialization. Regularly updating the Linux kernel to include patches addressing network subsystem error handling is the primary defense against such stability issues. Additionally, developers integrating this driver into custom builds must verify that their build configurations do not inadvertently trigger registration edge cases without proper cleanup routines in place.