CVE-2026-98620: net: ethernet: mtk_eth_soc: unregister net_devices in case of probe failure
In the Linux kernel, the following vulnerability has been resolved:
net: ethernet: mtkethsoc: unregister netdevices in case of probe failure
If registernetdev() fails for one of the MTKMAXDEVS devices in mtkprobe(), the error path jumps to errdeinitppe, skipping mtkunregdev(). The previously registered netdevices are then freed by mtkfreedev() while still in NETREGREGISTERED state, hitting the BUGON(dev->regstate != NETREGUNREGISTERED).
Route the registernetdev() failure to errunregnetdev so the netdevices registered so far are properly unregistered before being freed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.159.1-1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In mtk_probe(), route register_netdev() failures to err_unreg_netdev so net_devices registered so far are unregistered before mtk_free_dev() frees them.
Event History
Frequently Asked Questions
When can this issue be triggered?
It is triggered when mtk_probe() registers multiple network devices and register_netdev() fails for one of the MTK_MAX_DEVS devices after earlier devices have already been registered.
What is the impact of the faulty error path?
Previously registered network devices are freed while still in the NETREG_REGISTERED state, causing the kernel BUG_ON check for an unregistered state to fire.
What does the fix change?
The fix routes register_netdev() failures to the err_unreg_netdev cleanup path, which unregisters devices that were registered before they are freed.