UBUNTU-CVE-2026-99198: Null Pointer Dereference
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: actions: Move setting of netops to fix crash owlemacprobe() calls owlemacphyinit(), which connects the PHY, before netdev->netdevops is assigned. phyattachdirect() -> phylinktopoaddphy() reads dev->netdevops through netdevneedopslock() since the commit in question, so probing crashes with a NULL pointer dereference when CONFIGNETSHAPER is enabled. Assign netdevops before the PHY attach, as was done for emac in commit 7c9f391ec89c ("net: emac: move setting of netops to fix crash").
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Assign netdev->netdev_ops before calling owl_emac_phy_init() and attaching the PHY.
owl_emac netdev->netdev_ops assignment order = assigned before PHY attach
Event History
Frequently Asked Questions
What conditions are required to trigger the crash?
The failure occurs during owl_emac device probing when CONFIG_NET_SHAPER is enabled. The driver connects the PHY before assigning netdev_ops, allowing a NULL pointer dereference during PHY attachment.
What is the operational impact?
Affected systems can crash while initializing the owl_emac Ethernet device. The provided information identifies this as a NULL pointer dereference rather than an attacker-controlled privilege escalation or data disclosure issue.
Which Ubuntu kernel packages are listed as affected?
The listed packages are ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-hwe-edge, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-aws-5.0, and ubuntu/linux-aws-5.3.