{"id":"CVE-2026-98922","kind":"vulnerability","aliases":["CVE-2026-98922"],"related":[],"title":"Linux kernel: PowerPC emac driver crashes on boot from NULL pointer","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: emac: move setting of netops to fix crash\n\nfixes the following crash on driver initialization:\n\n|BUG: Kernel NULL pointer dereference on read at 0x00000158\n|Faulting instruction address: 0xc0566b40\n|Oops: Kernel access of bad area, sig: 11 [#1]\n|BE PAGE_SIZE=4K  PowerPC 44x Platform\n|Modules linked in:\n|CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Tainted: GW 7.3.0-rc3+ #1\n|Tainted: [W]=WARN\n|Hardware name: MyBook Live APM821XX 0x12c41c83 PowerPC 44x Platform\n|NIP:  c0566b40 LR: c05648f8 CTR: c04c1e9c\n|REGS: c1053a20 TRAP: 0300   Tainted: GW  (7.3.0-rc3+)\n|MSR:  0002b000 <CE,EE,FP,ME>  CR: 24008808  XER: 00000000\n|DEAR: 00000158 ESR: 00000000\n|GPR00: c05648f8 c1053b10 c1063600 c1030000 c5ab3000 00000000 [...]\n|GPR08: 00000002 00000000 00000000 c1053b40 84002808 00000000 [...]\n|GPR16: cfffd210 00000002 c0beafcc cfffc960 00000000 c1030644 [...]\n|GPR24: c0beafbc c1037000 00000000 0000000a 00000000 c1030000 [...]\n|NIP [c0566b40] phy_link_topo_add_phy+0x2c/0x1d0\n|LR [c05648f8] phy_attach_direct+0x1a4/0x368\n|Call Trace:\n|[c1053b10] [c0811e04] klist_put+0x54/0xb4 (unreliable)\n|[c1053b40] [c05648f8] phy_attach_direct+0x1a4/0x368\n|[c1053b70] [c0564ae8] phy_connect_direct+0x2c/0x60\n|[c1053b90] [c056c7a8] of_phy_connect+0x50/0x74\n|[c1053bc0] [c0572a88] emac_probe+0xd50/0x119c\n|[c1053c90] [c04cb770] platform_probe+0x74/0xa4\n|[c1053cb0] [c04c8f08] really_probe+0x120/0x2b0\n|[c1053cd0] [c04c9254] __driver_probe_device+0x1bc/0x1fc\n|[c1053d00] [c04c9334] driver_probe_device+0x38/0xa8\n|[c1053d30] [c04c9560] __driver_attach+0xf4/0x10c\n|[c1053d50] [c04c6af8] bus_for_each_dev+0x68/0xd0\n|[c1053d90] [c04c7c34] bus_add_driver+0xcc/0x1ec\n|[c1053dc0] [c04c9f6c] driver_register+0xcc/0x110\n|[c1053de0] [c0aa3f40] emac_init+0x1c4/0x200\n\nThis bug showed up starting with v7.3-rc1. At the NIP in\nphy_link_topo_add_phy() is a netdev_need_ops_lock() check.\nThis was added by the following\ncommit ded86da4bbb7 (\"net: ethtool: relax ethnl_req_get_phydev() locking assertion\")\n\nThe bug shows up because at the time of_phy_connect() was called, the\nnetdev_ops were *not yet* determined. My fix is to move the code that\nsets netdev_ops+commac.ops+ethtool_ops further up as emac_init_config()\nderives that by looking at the device-tree and sets the required\ndev->phy_mode accordingly.\n\nDuring review, the Sashiko bot's AI stated that the commac assignment\nbecame a dead store. Great catch! To keep the original behavior as-is,\none mentioned option \"set dev->commac.ops = &emac_commac_ops only in\nthe non-gige case?\" sounded like a great plan. So the dev->commac.ops\nassignment for the non-gige-case moves into the else block.\n\nThis patch was tested on a WD MyBook Live (RGMII). the device now works again.","summary":"The Linux kernel's emac Ethernet driver set up its netdev operations too late, so a PHY attach during probe dereferenced a NULL pointer and crashed the kernel at driver initialization. The sources describe a crash (denial of service) on affected PowerPC 44x boards, and do not describe code execution.","severity":"unknown","cvss":null,"epss":0.00198,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","linux-kernel","network-drivers","other","powerpc"],"not_affected_if":["kernel-before-7.3-rc1","no-emac-hardware"],"how_to_check":"- Check whether the running kernel is 7.3-rc1 or later with `uname -r`\n- Check whether the board uses the emac driver (PowerPC 44x, such as WD MyBook Live) with `lsmod | grep emac` or `dmesg | grep -i emac`","fix":"- Move to a Linux kernel build that includes the upstream fix for emac netops ordering (commit subject 'net: emac: move setting of netops to fix crash'); the sources do not name a fixed version number, so unknown\n- Until then, do not upgrade to 7.3-rc1 or later on emac-based PowerPC hardware","status":"open","published_at":"2026-10-23T13:17:12+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:58:19+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T04:58:19Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a Linux kernel build that includes the upstream fix for emac netops ordering (commit subject 'net: emac: move setting of netops to fix crash'); the sources do not name a fixed version number, so unknown\n- Until then, do not upgrade to 7.3-rc1 or later on emac-based PowerPC hardware","reach":"local","title":"Linux kernel: PowerPC emac driver crashes on boot from NULL pointer","impact":"low","summary":"The Linux kernel's emac Ethernet driver set up its netdev operations too late, so a PHY attach during probe dereferenced a NULL pointer and crashed the kernel at driver initialization. The sources describe a crash (denial of service) on affected PowerPC 44x boards, and do not describe code execution.","category":"other","nicknames":[],"who_cares":["linux-kernel","powerpc","embedded","network-drivers"],"confidence":0.6,"needs_auth":"no","worst_case":"Kernel crashes during boot, leaving the device unusable until fixed","analyst_note":"","how_to_check":"- Check whether the running kernel is 7.3-rc1 or later with `uname -r`\n- Check whether the board uses the emac driver (PowerPC 44x, such as WD MyBook Live) with `lsmod | grep emac` or `dmesg | grep -i emac`","needs_analyst":false,"not_affected_if":["no-emac-hardware","kernel-before-7.3-rc1"],"who_is_affected":"Only systems running Linux kernels from v7.3-rc1 onward that load the emac Ethernet driver, which the sources describe on PowerPC 44x boards such as the WD MyBook Live (RGMII). The crash happens during driver initialization at boot. Teams running x86, ARM or other hardware without the emac driver can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000802,"input_tokens":4683,"output_tokens":667,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':223C,230C,238C,246C,253C,260C,266C,272C,278C,285C,292C,298C,306C,313C,319C,325C '-2026':13A,16A '-98922':14A,17A '0':136C,138C '00000000':183C,187C,194C,197C,198C,201C,207C,212C,214C '00000002':196C,204C '0000000a':213C '00000158':185C '0002b000':175C '0300':169C '0x00000158':111C '0x12c41c83':156C '0xc0566b40':115C '1':124C,140C,147C '11':123C '24008808':181C '44x':69B,130C,158C '4k':128C '7.3.0':145C,172C '84002808':200C 'access':118C 'accord':423C 'add':221C,311C,341C,352C 'address':114C 'affect':67B 'ai':430C 'apm821xx':155C 'area':121C 'as-i':447C 'assert':366C 'assign':435C,475C 'attach':44B,228C,244C,297C 'bad':120C 'becam':436C 'behavior':446C 'block':486C 'board':70B 'boot':8A 'bot':428C 'bug':103C,328C,368C 'bus':302C,310C 'c04c1e9c':165C 'c04c6af8':301C 'c04c7c34':309C 'c04c8f08':275C 'c04c9254':281C 'c04c9334':288C 'c04c9560':295C 'c04c9f6c':316C 'c04cb770':269C 'c05648f8':163C,189C,226C,242C 'c0564ae8':249C 'c0566b40':161C,217C 'c056c7a8':256C 'c0572a88':263C 'c0811e04':235C 'c0aa3f40':322C 'c0beafbc':210C 'c0beafcc':205C 'c1030000':192C,215C 'c1030644':208C 'c1037000':211C 'c1053a20':167C 'c1053b10':190C,234C 'c1053b40':199C,241C 'c1053b70':248C 'c1053b90':255C 'c1053bc0':262C 'c1053c90':268C 'c1053cb0':274C 'c1053cd0':280C 'c1053d00':287C 'c1053d30':294C 'c1053d50':300C 'c1053d90':308C 'c1053dc0':315C 'c1053de0':321C 'c1063600':191C 'c5ab3000':193C 'call':232C,379C 'case':465C,481C 'catch':441C 'ce':176C 'cfffc960':206C 'cfffd210':203C 'check':349C 'code':75B,393C 'comm':141C 'commac':434C,457C 'commac.ops':398C,455C,474C 'commit':356C 'config':406C 'connect':251C,259C,377C 'cpu':135C 'cr':180C 'crash':6A,52B,62B,95C,99C 'ctr':164C 'cve':12A,15A 'dead':438C 'dear':184C 'ded86da4bbb7':357C 'denial':63B 'derefer':107C 'dereferenc':47B 'deriv':407C 'describ':60B,74B 'determin':386C 'dev':305C,420C,454C,473C 'devic':284C,291C,414C,498C 'device-tre':413C 'direct':229C,245C,252C 'driver':5A,24B,33B,56B,101C,282C,289C,296C,312C,317C 'ee':177C 'els':485C 'emac':4A,31B,88C,264C,323C,404C,456C 'embed':18B 'esr':186C 'ethernet':32B 'ethnl':361C 'ethtool':359C,399C 'execut':76B 'fault':112C 'fix':94C,96C,388C 'follow':82C,98C,355C 'fp':178C 'get':363C 'gige':464C,480C 'gpr00':188C 'gpr08':195C 'gpr16':202C 'gpr24':209C 'great':440C,469C 'gw':144C,171C 'hardwar':151C 'init':324C,405C 'initi':57B,102C 'instruct':113C 'keep':443C 'kernel':2A,21B,29B,54B,80C,104C,117C 'klist':236C 'late':40B 'like':467C 'link':133C,219C,339C 'linux':1A,20B,28B,79C 'linux-kernel':19B 'live':154C,495C 'lock':348C,365C 'look':410C 'lr':162C,225C 'mention':451C 'mode':422C 'modul':132C 'move':89C,391C,482C 'msr':174C 'mybook':153C,494C 'name':152C 'need':346C 'net':87C,358C 'netdev':37B,345C,381C,396C 'netop':92C 'network':23B 'network-driv':22B 'nip':160C,216C,336C 'non':463C,479C 'non-gig':462C 'non-gige-cas':478C 'null':10A,49B,105C 'one':450C 'oop':116C 'op':347C,382C,397C,400C,458C 'oper':38B 'option':452C 'origin':445C 'page':126C 'patch':488C 'phi':43B,218C,222C,227C,243C,250C,258C,338C,342C,376C,421C 'phydev':364C 'pid':139C 'plan':470C 'platform':131C,159C,270C 'pointer':11A,50B,106C 'powerpc':3A,26B,68B,129C,157C 'probe':46B,265C,271C,277C,283C,290C 'put':237C 'rc3':146C,173C 'read':109C 'realli':276C 'reg':166C 'regist':318C 'relax':360C 'req':362C 'requir':419C 'resolv':86C 'review':425C 'rgmii':496C 'sashiko':427C 'servic':65B 'set':34B,90C,395C,417C,453C 'show':329C,369C 'sig':122C 'size':127C 'sound':466C 'sourc':59B 'start':331C 'state':431C 'store':439C 'swapper/0':142C 'taint':143C,148C,170C 'test':490C 'time':374C 'topo':220C,340C 'trace':233C 'trap':168C 'tree':415C 'uid':137C 'unreli':240C 'v7.3-rc1':333C 'vulner':83C 'w':149C 'warn':150C 'wd':493C 'work':500C 'x120/0x2b0':279C 'x1a4/0x368':231C,247C 'x1bc/0x1fc':286C 'x1c4/0x200':326C 'x2c/0x1d0':224C 'x2c/0x60':254C 'x38/0xa8':293C 'x50/0x74':261C 'x54/0xb4':239C 'x68/0xd0':307C 'x74/0xa4':273C 'xcc/0x110':320C 'xcc/0x1ec':314C 'xd50/0x119c':267C 'xer':182C 'xf4/0x10c':299C 'yet':385C","nicknames":[],"mitigations":[],"who_affected":"Only systems running Linux kernels from v7.3-rc1 onward that load the emac Ethernet driver, which the sources describe on PowerPC 44x boards such as the WD MyBook Live (RGMII). The crash happens during driver initialization at boot. Teams running x86, ARM or other hardware without the emac driver can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:12+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98922","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98922","severity":null,"published_at":"2026-10-23T13:17:12+00:00","modified_at":"2026-10-23T13:17:12+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-98922","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98922","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}