Live › vulnerability › CVE-2026-99194
Go to dashboardIn the Linux kernel's Aeroflex (GRETH) Ethernet driver, the netdev operations were assigned after the PHY was attached, so probing the device dereferences a NULL pointer when CONFIG_NET_SHAPER is enabled. The fix moves the netdev_ops assignment ahead of the PHY attach, which the sources describe as the same change made earlier for the emac driver.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 11:32 UTC. All times on this page are UTC.
Systems running a Linux kernel with the Aeroflex GRETH Ethernet driver and CONFIG_NET_SHAPER enabled, where the device is probed at boot. The sources describe a crash (denial of service) during probe, not code execution. Systems without this hardware or without CONFIG_NET_SHAPER are unlikely to be affected.
No product ranges from the sources yet.
CONFIG_NET_SHAPER is enabled in the running kernel configEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
net: ethernet: aeroflex: move setting of netops to fix crash
greth_of_probe() calls greth_mdio_init(), which connects the PHY, before dev->netdev_ops is assigned. phy_attach_direct() -> phy_link_topo_add_phy() reads dev->netdev_ops through netdev_need_ops_lock() since the commit in question, so probing crashes with a NULL pointer dereference when CONFIG_NET_SHAPER is enabled.
Assign netdev_ops before the PHY attach, as was done for emac in commit 7c9f391ec89c ("net: emac: move setting of netops to fix crash").
This page as .md · .json · in your agent: get_signal("CVE-2026-99194")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.