---
id: "CVE-2026-99194"
kind: "vulnerability"
aliases: ["CVE-2026-99194"]
title: "Linux kernel: Aeroflex Ethernet driver crashes on probe with shaper enabled"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["embedded", "ethernet", "infrastructure", "kernel", "linux"]
not_affected_if: ["config-net-shaper-disabled", "no-aeroflex-hardware"]
published_at: "2026-10-28T11:17:40+00:00"
first_seen_at: "2026-10-28T11:32:37+00:00"
updated_at: "2026-10-28T11:34:09+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99194", "first_seen_at": "2026-10-28T11:32:37+00:00"}]
---

# Linux kernel: Aeroflex Ethernet driver crashes on probe with shaper enabled

In the Linux kernel's Aeroflex (GRETH) Ethernet driver, the netdev operations were assigned after the PHY was attached, so probing the device dereferences a NULL pointer when CONFIG_NET_SHAPER is enabled. The fix moves the netdev_ops assignment ahead of the PHY attach, which the sources describe as the same change made earlier for the emac driver.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- Update the Linux kernel to a release that includes the upstream commit moving netdev_ops assignment in the aeroflex driver (version unknown from sources)
- Check whether `CONFIG_NET_SHAPER` is enabled in the running kernel config

## Timeline

- 2026-10-28T11:32:37+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99194

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

net: ethernet: aeroflex: move setting of netops to fix crash

greth_of_probe() calls greth_mdio_init(), which connects the PHY,
before dev->netdev_ops is assigned. phy_attach_direct() ->
phy_link_topo_add_phy() reads dev->netdev_ops through
netdev_need_ops_lock() since the commit in question, so probing crashes
with a NULL pointer dereference when CONFIG_NET_SHAPER is enabled.

Assign netdev_ops before the PHY attach, as was done for emac in commit
7c9f391ec89c ("net: emac: move setting of netops to fix crash").

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_