CVE-2026-99197 in Linux
Summary
by MITRE • 10/28/2026
In the Linux kernel, the following vulnerability has been resolved:
net: mv643xx: move setting of netops to fix crash
mv643xx_eth_probe() connects the PHY before dev->netdev_ops is assigned. phy_attach_direct() -> phy_link_topo_add_phy() reads dev->netdev_ops through netdev_need_ops_lock() since the commit in question, so probing crashes with a NULL pointer dereference when CONFIG_NET_SHAPER is enabled.
Assign netdev_ops before the PHY attach, as was done for emac in commit 7c9f391ec89c ("net: emac: move setting of netops to fix crash").
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified within the Linux kernel network subsystem involves a critical initialization sequence error in the mv643xx_eth driver, specifically affecting systems where the CONFIG_NET_SHAPER configuration option is enabled. This issue manifests as a NULL pointer dereference during the device probing phase, which can lead to system instability or a complete crash of the operating environment. The root cause lies in the ordering of operations within the mv643xx_eth_probe function, where the driver attempts to attach the physical layer interface before initializing the network device operations structure. This sequencing flaw exposes an internal dependency that was not previously accounted for under specific kernel configurations.
The technical mechanism behind this failure involves the interaction between PHY attachment routines and netdev operation locks. When phy_attach_direct is invoked, it subsequently calls phy_link_topo_add_phy to manage topology information regarding the physical connection. Within this call chain, the function netdev_need_ops_lock is executed, which attempts to access dev->netdev_ops to determine locking requirements for network device operations. Because mv643xx_eth_probe had not yet assigned a value to dev->netdev_ops at this stage of execution, the pointer remains NULL. Consequently, any attempt to dereference this null pointer results in an immediate kernel panic or crash, effectively preventing the system from booting correctly on affected hardware configurations that rely on this driver and the net shaper feature.
This type of vulnerability is classified under CWE-476, which denotes a NULL Pointer Dereference. It represents a fundamental failure in input validation and state management during object initialization. The flaw highlights the importance of strict adherence to dependency ordering when initializing complex subsystems within the kernel. By attempting to access members of an uninitialized structure, the code violates basic safety principles required for robust software engineering. Such errors are particularly dangerous because they can be triggered early in the boot process, often before any user-space interaction occurs, making them difficult to detect through standard application-level testing and requiring deep integration testing or static analysis tools that understand kernel initialization sequences.
From a threat modeling perspective aligned with MITRE ATT&CK techniques, this vulnerability falls under T1595.002, Active Scanning: Vulnerability Scanning, if an attacker were able to trigger the probe repeatedly in a managed environment, although more accurately it represents a reliability issue rather than an exploitable attack vector for remote code execution. However, in contexts where availability is critical, such as embedded systems or network infrastructure devices running Linux kernels, this crash constitutes a significant denial of service risk. The impact is primarily localized to the stability and availability of the host system, potentially causing downtime until the kernel is patched or reconfigured without NET_SHAPER support.
The resolution involves correcting the initialization order within mv643xx_eth_probe by ensuring that dev->netdev_ops is assigned before any calls to phy_attach_direct are made. This approach mirrors fixes applied in other network drivers such as emac, demonstrating a consistent pattern for addressing similar structural flaws across different hardware interfaces. By establishing the net device operations early, subsequent PHY attachment routines can safely access these structures without encountering null references. This fix ensures that all dependent functions operate on valid memory addresses and initialized data structures, thereby restoring system stability.
To mitigate this vulnerability in environments where patching is not immediately feasible, administrators may consider disabling CONFIG_NET_SHAPER during kernel configuration if the net shaper functionality is not strictly required for their specific use case. However, relying on workarounds is generally discouraged as it reduces feature availability and does address the underlying code defect. The recommended long-term mitigation is to apply the upstream kernel patch that reorders these initialization steps. Regular maintenance of kernel versions and applying security updates provided by distribution vendors are essential practices to ensure protection against such low-level structural vulnerabilities that can compromise system integrity and uptime.