CVE-2026-31736: net: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled
In the Linux kernel, the following vulnerability has been resolved:
net: ethernet: mtkppe: avoid NULL deref when gmac0 is disabled
If the gmac0 is disabled, the precheck for a valid ingress device will cause a NULL pointer deref and crash the system. This happens because eth->netdev[0] will be NULL but the code will directly try to access netdevops.
Instead of just checking for the first netdevice, it must be checked if any of the mtketh netdevices is matching the netdevops of the ingress device.
Affected Software
Remediation
Event History
Frequently Asked Questions
Which systems are exposed to this crash condition?
Systems using the Linux kernel mtk_ppe Ethernet component are exposed when gmac0 is disabled. The vulnerable path is triggered by processing an ingress device while eth->netdev[0] is NULL.
What access does an attacker need to trigger the issue?
The supplied CVSS vector rates the issue as locally exploitable with low privileges and no user interaction. Successful exploitation causes a system crash; no confidentiality or integrity impact is listed.
Is there a fix available?
Yes. A patch is available, with fixes referenced in the provided stable kernel commits.