UBUNTU-CVE-2026-99196: Null Pointer Dereference
In the Linux kernel, the following vulnerability has been resolved: net: au1000: move setting of netops to fix crash au1000probe() calls au1000miiprobe(), which connects the PHY, before dev->netdevops is assigned. phyattachdirect() -> phylinktopoaddphy() reads dev->netdevops through netdevneedopslock() since the commit in question, so probing crashes with a NULL pointer dereference when CONFIGNETSHAPER is enabled. Assign netdevops before the PHY attach, as was done for emac in commit 7c9f391ec89c ("net: emac: move setting of netops to fix crash").
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Assign dev->netdev_ops before au1000_probe() calls au1000_mii_probe() to prevent the NULL pointer dereference when CONFIG_NET_SHAPER is enabled.
Linux kernel au1000 driver dev->netdev_ops = assigned before PHY attach
Event History
Frequently Asked Questions
Which Ubuntu kernel packages are listed as affected?
The listed packages are ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-hwe-edge, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-aws-5.0, and ubuntu/linux-aws-5.3.
What configuration is required for the crash to occur?
The crash occurs when CONFIG_NET_SHAPER is enabled and the au1000 driver probes a device. The failure happens during PHY attachment because netdev_ops has not yet been assigned.
How can I recognize this issue in an affected system?
An affected system can crash with a NULL pointer dereference while au1000_probe() is attaching the PHY. The relevant sequence involves au1000_mii_probe(), phy_attach_direct(), and a read of dev->netdev_ops.