UBUNTU-CVE-2026-99197: Null Pointer Dereference
In the Linux kernel, the following vulnerability has been resolved: net: mv643xx: move setting of netops to fix crash mv643xxethprobe() connects the PHY before dev->netdevops is assigned. phyattachdirect() -> phylinktopoaddphy() reads dev->netdevops through netdevneedopslock() since the commit in question, so probing crashes with a NULL pointer dereference when CONFIGNETSHAPER is enabled. Assign netdevops before the PHY attach, as was done for emac in commit 7c9f391ec89c ("net: emac: move setting of netops to fix crash").
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Assign dev->netdev_ops before calling the PHY attach operation in mv643xx_eth_probe().
Linux kernel mv643xx Ethernet driver dev->netdev_ops = assigned before PHY attach
Event History
Frequently Asked Questions
What systems are exposed to the crash condition?
The issue affects systems using the mv643xx Ethernet driver where CONFIG_NET_SHAPER is enabled. The affected Ubuntu kernel package families listed are linux-riscv, linux-realtime, linux-hwe-edge, linux-azure, linux-gcp, linux-azure-fde, linux-aws-5.0, and linux-aws-5.3.
What triggers the failure?
The failure occurs during mv643xx Ethernet device probing, when the driver attaches the PHY before assigning netdev_ops. With CONFIG_NET_SHAPER enabled, the PHY attach path reads the uninitialized netdev_ops pointer and causes a NULL pointer dereference.
Is this remotely exploitable through normal network traffic?
The provided information describes a crash during local device-driver probe and does not identify a network-request or remote-input trigger. It does not provide evidence that ordinary network traffic can exploit the issue.