Live › vulnerability › CVE-2026-99195
Go to dashboardIn the Linux kernel's ethoc Ethernet driver, netdev_ops is assigned after the PHY is attached, so probing the device dereferences a NULL pointer when CONFIG_NET_SHAPER is enabled. The result is a kernel crash during driver probe, a denial of service rather than a confirmed code execution path.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 11:32 UTC. All times on this page are UTC.
Only systems running a Linux kernel with the ethoc driver and CONFIG_NET_SHAPER enabled are at risk, which is mostly embedded boards that use this Ethernet controller. Servers and desktops with other NICs, or kernels without ethoc or without CONFIG_NET_SHAPER, can skip it.
No product ranges from the sources yet.
CONFIG_NET_SHAPER enabled and whether the ethoc driver is loaded, e.g. lsmod | grep ethoc or grep ETHOC /proc/modulesuname -r against the fixed stable release listed in the kernel git commitEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
net: ethoc: move setting of netops to fix crash
ethoc_probe() calls ethoc_mdio_probe(), which connects the PHY, before netdev->netdev_ops is assigned. phy_attach_direct() -> phy_link_topo_add_phy() reads dev->netdev_ops through netdev_need_ops_lock() since the commit in question, so probing crashes with a NULL pointer dereference when CONFIG_NET_SHAPER is enabled.
Assign netdev_ops before the PHY attach, as was done for emac in commit 7c9f391ec89c ("net: emac: move setting of netops to fix crash").
This page as .md · .json · in your agent: get_signal("CVE-2026-99195")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.