{"id":"CVE-2026-99195","kind":"vulnerability","aliases":["CVE-2026-99195"],"related":[],"title":"Linux kernel: ethoc driver crashes on probe with NULL pointer dereference","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethoc: move setting of netops to fix crash\n\nethoc_probe() calls ethoc_mdio_probe(), which connects the PHY,\nbefore netdev->netdev_ops is assigned. phy_attach_direct() ->\nphy_link_topo_add_phy() reads dev->netdev_ops through\nnetdev_need_ops_lock() since the commit in question, so probing crashes\nwith a NULL pointer dereference when CONFIG_NET_SHAPER is enabled.\n\nAssign netdev_ops before the PHY attach, as was done for emac in commit\n7c9f391ec89c (\"net: emac: move setting of netops to fix crash\").","summary":"In the Linux kernel's ethoc Ethernet driver, netdev_ops is assigned after the PHY is attached, so probing the device dereferences a NULL pointer when CONFIG_NET_SHAPER is enabled. The result is a kernel crash during driver probe, a denial of service rather than a confirmed code execution path.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","ethoc","linux-kernel","runtime"],"not_affected_if":["config-net-shaper-disabled","no-ethoc-driver"],"how_to_check":"- Check whether the kernel is built with `CONFIG_NET_SHAPER` enabled and whether the `ethoc` driver is loaded, e.g. `lsmod | grep ethoc` or `grep ETHOC /proc/modules`\n- Check the running kernel version with `uname -r` against the fixed stable release listed in the kernel git commit\n- unknown for whether affected hardware is present in practice","fix":"- Update the Linux kernel to a stable release that includes the upstream commit moving the netdev_ops assignment before the PHY attach in ethoc_probe (the fixed version is not stated in the sources)\n- unknown for specific fixed kernel version numbers","status":"open","published_at":"2026-10-28T11:17:40+00:00","first_seen_at":"2026-10-28T11:32:37+00:00","triaged_at":"2026-10-28T11:34:08+00:00","updated_at":"2026-10-28T11:34:08+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-28T11:34:08Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a stable release that includes the upstream commit moving the netdev_ops assignment before the PHY attach in ethoc_probe (the fixed version is not stated in the sources)\n- unknown for specific fixed kernel version numbers","reach":"local","title":"Linux kernel: ethoc driver crashes on probe with NULL pointer dereference","impact":"low","summary":"In the Linux kernel's ethoc Ethernet driver, netdev_ops is assigned after the PHY is attached, so probing the device dereferences a NULL pointer when CONFIG_NET_SHAPER is enabled. The result is a kernel crash during driver probe, a denial of service rather than a confirmed code execution path.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","embedded","ethoc"],"confidence":0.6,"needs_auth":"no","worst_case":"Kernel crashes during driver probe, causing denial of service","analyst_note":"Confirm the fixed kernel stable versions and the upstream commit reference from the kernel.org or NVD entry for CVE-2026-99195.","how_to_check":"- Check whether the kernel is built with `CONFIG_NET_SHAPER` enabled and whether the `ethoc` driver is loaded, e.g. `lsmod | grep ethoc` or `grep ETHOC /proc/modules`\n- Check the running kernel version with `uname -r` against the fixed stable release listed in the kernel git commit\n- unknown for whether affected hardware is present in practice","needs_analyst":true,"not_affected_if":["no-ethoc-driver","config-net-shaper-disabled"],"who_is_affected":"Only systems running a Linux kernel with the ethoc driver and CONFIG_NET_SHAPER enabled are at risk, which is mostly embedded boards that use this Ethernet controller. Servers and desktops with other NICs, or kernels without ethoc or without CONFIG_NET_SHAPER, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.00071,"input_tokens":3454,"output_tokens":730,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-99195':14A,17A '7c9f391ec89c':160C 'add':116C 'assign':35B,109C,146C 'attach':40B,111C,152C 'call':96C 'code':72B 'commit':129C,159C 'config':50B,141C 'confirm':71B 'connect':101C 'crash':5A,60B,93C,134C,169C 'cve':12A,15A 'denial':65B 'derefer':11A,45B,139C 'dev':119C 'devic':44B 'direct':112C 'done':155C 'driver':4A,31B,62B 'emac':157C,162C 'embed':18B 'enabl':54B,145C 'ethernet':30B 'ethoc':3A,19B,29B,86C,94C,97C 'execut':73B 'fix':92C,168C 'follow':80C 'kernel':2A,22B,27B,59B,78C 'link':114C 'linux':1A,21B,26B,77C 'linux-kernel':20B 'lock':126C 'mdio':98C 'move':87C,163C 'need':124C 'net':51B,85C,142C,161C 'netdev':32B,105C,106C,120C,123C,147C 'netop':90C,166C 'null':9A,47B,137C 'op':33B,107C,121C,125C,148C 'path':74B 'phi':38B,103C,110C,113C,117C,151C 'pointer':10A,48B,138C 'probe':7A,42B,63B,95C,99C,133C 'question':131C 'rather':68B 'read':118C 'resolv':84C 'result':56B 'runtim':23B 'servic':67B 'set':88C,164C 'shaper':52B,143C 'sinc':127C 'topo':115C 'vulner':81C","nicknames":[],"mitigations":[],"who_affected":"Only systems running a Linux kernel with the ethoc driver and CONFIG_NET_SHAPER enabled are at risk, which is mostly embedded boards that use this Ethernet controller. Servers and desktops with other NICs, or kernels without ethoc or without CONFIG_NET_SHAPER, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:40+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99195","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99195","severity":null,"published_at":"2026-10-28T11:17:40+00:00","modified_at":"2026-10-28T11:17:40+00:00","first_seen_at":"2026-10-28T11:32:37+00:00","fetched_at":"2026-10-28T11:32:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}