UBUNTU-CVE-2026-99200: Null Pointer Dereference
In the Linux kernel, the following vulnerability has been resolved: net: hisilicon: hisifemac: Move setting of netops to fix crash hisifemacdrvprobe() connects the PHY before dev->netdevops is assigned. phyattachdirect() -> phylinktopoaddphy() reads dev->netdevops through netdevneedopslock() since the commit in question, so probing crashes with a NULL pointer dereference when CONFIGNETSHAPER is enabled. phylinktopoaddphy from phyattachdirect+0xec/0x37c ofphygetandconnect from hisifemacdrvprobe+0x1f4/0x558 Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b Assign netdevops before the PHY attach, as was done for emac in commit 7c9f391ec89c ("net: emac: move setting of netops to fix crash").
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In hisi_femac_drv_probe(), assign dev->netdev_ops before connecting or attaching the PHY, preventing phy_attach_direct() from reading a NULL netdev_ops pointer when CONFIG_NET_SHAPER is enabled.
Event History
Frequently Asked Questions
What systems are exposed to the crash?
Systems using the HiSilicon FEMAC network driver are exposed during driver probing when CONFIG_NET_SHAPER is enabled. The issue occurs while the driver connects its PHY before assigning netdev_ops.
What is the practical impact of triggering this issue?
The NULL pointer dereference occurs during network-driver probe and can cause a kernel panic, including an "Attempted to kill init" failure. This can prevent the affected system from completing boot or initializing the network device.
Does exploitation require an unauthenticated remote attacker?
The provided information describes a driver initialization ordering flaw, not a remotely triggered attack path. It identifies the affected configuration as use of the HiSilicon FEMAC driver with CONFIG_NET_SHAPER enabled.
What is the relevant mitigation if an update cannot be applied immediately?
Avoid the affected configuration where feasible: do not enable CONFIG_NET_SHAPER on systems that use the HiSilicon FEMAC driver. The resolved fix assigns netdev_ops before attaching the PHY.