DEBIAN-CVE-2026-99194: Null Pointer Dereference

Published Oct 28, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: aeroflex: move setting of netops to fix crash grethofprobe() calls grethmdioinit(), which connects the PHY, before dev->netdevops is assigned. phyattachdirect() -> phylinktopoaddphy() reads dev->netdevops through netdevneedopslock() since the commit in question, so probing crashes with a NULL pointer dereference when CONFIGNETSHAPER is enabled. Assign netdevops before the PHY attach, as was done for emac in commit 7c9f391ec89c ("net: emac: move setting of netops to fix crash").

Affected Software

1 affected component

debian/linux*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Configuration
Assign dev->netdev_ops before greth_mdio_init() attaches the PHY in greth_of_probe().
Linux kernel Aeroflex greth driver netdev_ops = assigned before PHY attach

Event History

Oct 28, 2026

CVE Published

via OSV·11:17 AM

Data Sourced

via OSV·11:17 AM

DescriptionAffected Software

Frequently Asked Questions

Which systems are exposed to the crash?

Systems using the Linux kernel Aeroflex GRETH Ethernet driver are affected when CONFIG_NET_SHAPER is enabled. The failure occurs while the GRETH device is being probed and its PHY is attached.

What triggers the vulnerability?

The crash is triggered during GRETH driver initialization because the driver attaches the PHY before assigning netdev_ops. With CONFIG_NET_SHAPER enabled, the PHY attachment path reads the uninitialized netdev_ops pointer and can dereference NULL.

Does exploitation require network traffic or an unprivileged remote attacker?

The described trigger is local device probing during driver initialization, not network traffic. The available information does not identify a remote attack path or specific attacker privileges.

What is the immediate mitigation if an updated kernel cannot be deployed?

Avoid enabling CONFIG_NET_SHAPER on kernels using the affected GRETH driver, or avoid loading/using the GRETH driver where feasible. The issue is avoided by ensuring netdev_ops is assigned before the PHY attach during probe.

DEBIAN-CVE-2026-99194: Null Pointer Dereference

Affected Software

Remediation

Event History

Frequently Asked Questions

Which systems are exposed to the crash?

What triggers the vulnerability?

Does exploitation require network traffic or an unprivileged remote attacker?

What is the immediate mitigation if an updated kernel cannot be deployed?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to the crash?

What triggers the vulnerability?

Does exploitation require network traffic or an unprivileged remote attacker?

What is the immediate mitigation if an updated kernel cannot be deployed?