CVE-2026-99194 in Linux
Summary
by MITRE • 10/28/2026
In the Linux kernel, the following vulnerability has been resolved:
net: ethernet: aeroflex: move setting of netops to fix crash
greth_of_probe() calls greth_mdio_init(), which connects the PHY, before dev->netdev_ops is assigned. phy_attach_direct() -> phy_link_topo_add_phy() reads dev->netdev_ops through netdev_need_ops_lock() since the commit in question, so probing crashes with a NULL pointer dereference when CONFIG_NET_SHAPER is enabled.
Assign netdev_ops before the PHY attach, as was done for emac in commit 7c9f391ec89c ("net: emac: move setting of netops to fix crash").
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/28/2026
The identified vulnerability represents a critical initialization sequence error within the Linux kernel's network subsystem, specifically affecting the Aeroflex Gaisler Ethernet (greth) driver. This issue manifests as a NULL pointer dereference that occurs during the device probing phase when the CONFIG_NET_SHAPER configuration option is enabled. The root cause lies in the ordering of operations performed by the greth_of_probe function. Specifically, this probe routine invokes greth_mdio_init to establish connectivity with the physical layer (PHY) before assigning the netdev_ops structure to the network device object. This sequence violation creates a race condition or logic error where subsequent functions expect certain data structures to be initialized but find them unset, leading to system instability and potential denial of service through kernel panic.
The technical flaw is triggered by the interaction between PHY attachment routines and new locking mechanisms introduced in recent kernel updates. When phy_attach_direct calls phy_link_topo_add_phy, this function attempts to access dev->netdev_ops via netdev_need_ops_lock. This specific call path was added to enforce proper synchronization around network device operations. However, because greth_of_probe had not yet populated the netdev_ops pointer at that stage of execution, the kernel attempts to dereference a NULL address. This results in an immediate crash, preventing the system from booting or initializing this hardware component correctly if the specific configuration is active. The vulnerability highlights how changes in core networking infrastructure can expose latent ordering bugs in out-of-tree or less frequently updated drivers like greth_of_probe.
From a classification perspective, this issue aligns with CWE-476, which denotes NULL Pointer Dereference vulnerabilities. In terms of operational impact, the primary consequence is system instability and unavailability of network services provided by devices utilizing the greth driver. For systems relying on Aeroflex Gaisler hardware in embedded or aerospace environments where CONFIG_NET_SHAPER might be enabled for traffic shaping capabilities, this bug renders the device non-functional until patched. The crash occurs early in the boot process during probe execution, meaning the failure is deterministic and reproducible under the specified configuration conditions rather than occurring sporadically due to complex race conditions involving concurrent access.
The resolution involves reordering the initialization steps within greth_of_probe to ensure that dev->netdev_ops is assigned before any PHY attachment operations are initiated. This approach mirrors a fix previously applied to the emac driver in commit 7c9f391ec89c, establishing consistency across similar Ethernet drivers in the kernel tree. By ensuring that all required data structures for network operation locking and management are present prior to interacting with the hardware topology functions, the NULL pointer dereference is prevented. This fix underscores the importance of strict initialization ordering in device driver development, particularly when integrating with evolving core subsystems like the networking stack.
Mitigation strategies primarily involve applying this kernel patch or updating to a version that includes it. For environments where immediate patching is not feasible, administrators can consider disabling CONFIG_NET_SHAPER if traffic shaping features are not strictly required for the specific deployment scenario involving greth hardware. However, given the fundamental nature of the initialization error, relying on configuration workarounds may limit functionality and is less robust than applying the code fix that corrects the structural dependency between netdev_ops assignment and PHY attachment routines.