CVE-2026-99199 in Linux
Summary
by MITRE • 10/28/2026
In the Linux kernel, the following vulnerability has been resolved:
net: hisilicon: hip04_eth: Move setting of netops to fix crash
hip04_mac_probe() calls of_phy_connect() before ndev->netdev_ops is assigned. phy_attach_direct() -> phy_link_topo_add_phy() reads dev->netdev_ops through netdev_need_ops_lock() since the commit in question, so probing crashes with a NULL pointer dereference when CONFIG_NET_SHAPER is enabled.
Assign netdev_ops before the PHY attach, as was done for emac in commit 7c9f391ec89c ("net: emac: move setting of netops to fix crash").
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified within the Linux kernel involves a critical NULL pointer dereference located in the network driver subsystem, specifically affecting the Hisilicon hip04 Ethernet controller. This issue arises from an incorrect initialization sequence during the device probing phase. The root cause lies in the order of operations performed by the hip04_mac_probe function, which attempts to establish a connection with the physical layer interface via of_phy_connect before assigning the netdev_ops structure to the network device instance. Under normal circumstances, this ordering might not trigger an immediate failure; however, when the kernel configuration option CONFIG_NET_SHAPER is enabled, the internal logic changes significantly due to dependencies introduced by recent commits in the networking stack.
The technical flaw manifests because phy_attach_direct invokes phy_link_topo_add_phy, which subsequently calls netdev_need_ops_lock. This function attempts to access the dev->netdev_ops pointer to determine locking requirements for network operations. Since the driver has not yet assigned this structure at the time of the PHY connection attempt, the kernel encounters a NULL pointer dereference. Such an error typically results in a system crash or panic during the boot process or when the interface is initialized, effectively rendering the network hardware unusable and potentially destabilizing the entire operating system depending on how the kernel handles the exception. This type of defect falls under CWE-476, which describes NULL Pointer Dereference vulnerabilities where software attempts to use an object reference that points to null memory.
From a broader security perspective, this vulnerability impacts availability by causing denial of service through system instability or crash. In terms of adversarial tactics, while this is primarily a stability issue rather than a direct exploitation vector for privilege escalation, it aligns with ATT&CK technique T1499 Endpoint Denial of Service if an attacker could trigger the initialization sequence repeatedly in a managed environment to disrupt network connectivity. The vulnerability highlights the importance of strict adherence to driver initialization protocols and the interdependencies between different subsystems within the kernel networking stack.
The resolution involves reordering the operations within hip04_mac_probe to ensure that netdev_ops is assigned before any attempt is made to connect with the PHY device. This fix mirrors a previous correction applied to the emac driver in commit 7c9f391ec89c, establishing consistency across different network drivers regarding initialization sequences. By ensuring that all necessary data structures are populated and valid prior to their use by dependent functions like phy_link_topo_add_phy, the risk of null pointer access is eliminated.
To mitigate this vulnerability in environments running affected kernel versions, it is essential to apply the latest available patches from Linux distribution vendors or upstream kernel maintainers. System administrators should verify that their kernels include fixes for network driver initialization sequences and monitor system logs for any signs of NULL pointer dereference errors during boot or interface activation. Regular updates to the operating system are critical as they incorporate these structural corrections, ensuring that the networking stack remains robust against such initialization race conditions and logic errors.