CVE-2026-80614: net: emac: Fix NULL pointer dereference in emac_probe
In the Linux kernel, the following vulnerability has been resolved:
net: emac: Fix NULL pointer dereference in emacprobe
Move devmrequestirq() after devmplatformioremapresource() so that dev->emacp is mapped before the interrupt handler can fire. An early interrupt hitting emacirq() would dereference the NULL dev->emacp and crash.
Also remove redundant error message. devmplatformioremapresource() already returns an error message with deverrprobe().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In the emac driver, reorder initialization so devm_platform_ioremap_resource() runs before devm_request_irq(), ensuring the interrupt handler cannot fire before dev->emacp is mapped and preventing a NULL dereference in emac_irq() / emac_probe.
Linux kernel networking driver (net: emac) devm_request_irq() ordering relative to devm_platform_ioremap_resource() = Move devm_request_irq() after devm_platform_ioremap_resource() - Compensating control
Remove the redundant error message because devm_request_irq() already returns an error message with dev_err_probe().
Event History
Frequently Asked Questions
What condition is required to trigger the crash?
An interrupt must occur early enough for emac_irq() to run before dev->emacp has been mapped by devm_platform_ioremap_resource(). The interrupt handler then dereferences the NULL dev->emacp pointer and can crash the kernel.
Which systems are realistically exposed?
Systems using the Linux kernel EMAC driver are exposed to this initialization-time race. The provided information does not identify affected kernel versions, platforms, or configurations.
What change resolves the issue?
The fix maps dev->emacp with devm_platform_ioremap_resource() before registering the interrupt with devm_request_irq(). This prevents the interrupt handler from running while dev->emacp is still NULL.