UBUNTU-CVE-2026-99194: Null Pointer Dereference
Published Oct 28, 2026
·Updated
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: aeroflex: move setting of netops to fix crash grethofprobe() calls grethmdioinit(), which connects the PHY, before dev->netdevops is assigned. phyattachdirect() -> phylinktopoaddphy() reads dev->netdevops through netdevneedopslock() since the commit in question, so probing crashes with a NULL pointer dereference when CONFIGNETSHAPER is enabled. Assign netdevops before the PHY attach, as was done for emac in commit 7c9f391ec89c ("net: emac: move setting of netops to fix crash").
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Assign dev->netdev_ops before attaching the PHY in greth_of_probe(), before the call to greth_mdio_init().