CVE-2026-98008: net: macb: fix NULL pointer dereference on unbind with fixed-link
In the Linux kernel, the following vulnerability has been resolved:
net: macb: fix NULL pointer dereference on unbind with fixed-link
When the device tree describes a fixed-link and has no "mdio" child node, macbmiiinit() returns early without allocating the MDIO bus, leaving bp->miibus as NULL.
Two cleanup paths then dereference this NULL bus:
1. On driver unbind, macbremove() unconditionally calls mdiobusunregister(bp->miibus), which oopses:
Unable to handle kernel NULL pointer dereference at virtual address 00000000000004a8 pc : mdiobusunregister+0x14/0xa4 lr : macbremove+0x38/0xa4 Call trace: mdiobusunregister+0x14/0xa4 (P) macbremove+0x38/0xa4 platformremove+0x20/0x30 devicereleasedriverinternal+0x1c8/0x224 unbindstore+0xb4/0xbc
2. On the probe error path in macbprobe(), reached when macbmiiinit() has succeeded but a subsequent step fails, the erroutunregistermdio label runs the same unconditional cleanup.
mdiobusunregister() and mdiobusfree() do not guard against a NULL bus, so guard the calls in both macbremove() and the probe error path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.158.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel macb network driver are exposed when the device tree defines a fixed-link but does not include an "mdio" child node. The affected failure occurs during driver unbind or during probe cleanup after a later initialization step fails.
What is required to trigger the vulnerability?
The affected macb driver must be bound to hardware described with the fixed-link/no-MDIO device-tree configuration. Triggering can occur when the driver is unbound; it can also occur if probing reaches a subsequent failure after MDIO initialization returns successfully without creating an MDIO bus.
What is the impact of successful triggering?
The kernel dereferences a NULL MDIO bus pointer in mdiobus_unregister(), causing an oops. This can disrupt the affected driver or system operation.
How can administrators determine whether they are affected?
Review the device tree used by systems with the macb driver for a fixed-link definition and the absence of an "mdio" child node. Kernel logs or crash traces showing macb_remove() calling mdiobus_unregister() during unbind are also indicative.