DEBIAN-CVE-2026-99197: Null Pointer Dereference
Published Oct 28, 2026
·Updated
In the Linux kernel, the following vulnerability has been resolved: net: mv643xx: move setting of netops to fix crash mv643xxethprobe() connects the PHY before dev->netdevops is assigned. phyattachdirect() -> phylinktopoaddphy() reads dev->netdevops through netdevneedopslock() since the commit in question, so probing crashes with a NULL pointer dereference when CONFIGNETSHAPER is enabled. Assign netdevops before the PHY attach, as was done for emac in commit 7c9f391ec89c ("net: emac: move setting of netops to fix crash").
Affected Software
1 affected component
debian/linux*
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Assign dev->netdev_ops before connecting or attaching the PHY in mv643xx_eth_probe(), matching the emac fix referenced by commit 7c9f391ec89c.
Linux kernel mv643xx Ethernet driver dev->netdev_ops assignment order = assigned before PHY attach
Event History
Oct 28, 2026
CVE Published
via OSV·11:17 AM
Data Sourced
via OSV·11:17 AM
DescriptionAffected Software