UBUNTU-CVE-2026-99199: Null Pointer Dereference
In the Linux kernel, the following vulnerability has been resolved: net: hisilicon: hip04eth: Move setting of netops to fix crash hip04macprobe() calls ofphyconnect() before ndev->netdevops is assigned. phyattachdirect() -> phylinktopoaddphy() reads dev->netdevops through netdevneedopslock() since the commit in question, so probing crashes with a NULL pointer dereference when CONFIGNETSHAPER is enabled. Assign netdevops before the PHY attach, as was done for emac in commit 7c9f391ec89c ("net: emac: move setting of netops to fix crash").
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Assign ndev->netdev_ops before calling of_phy_connect(), ensuring netdev_ops is set before the PHY attach path reads it.
Linux kernel net: hisilicon: hip04_eth ndev->netdev_ops assignment order = Assign before of_phy_connect() / PHY attach
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The issue affects the hip04 Ethernet driver in the listed Ubuntu kernel packages when CONFIG_NET_SHAPER is enabled. The failure occurs while the driver is probing and attaching its PHY.
What is the operational impact?
The affected probe path can dereference a NULL netdev_ops pointer and crash. This is a kernel stability issue associated with initialization of the hip04 Ethernet device.
How can I determine whether this is relevant to an observed failure?
Look for a crash during hip04 Ethernet driver probing or PHY attachment on a kernel built with CONFIG_NET_SHAPER enabled. The relevant call path includes hip04_mac_probe(), of_phy_connect(), phy_attach_direct(), and netdev_need_ops_lock().