Live › vulnerability › CVE-2026-99197
Go to dashboardThe mv643xx Ethernet driver assigns its network operations table after attaching the PHY, so with CONFIG_NET_SHAPER enabled the kernel dereferences a NULL pointer during probe. The sources describe a crash (denial of service) and do not describe code execution or data exposure.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 11:32 UTC. All times on this page are UTC.
Systems running a Linux kernel with the mv643xx Ethernet driver (common on older Marvell ARM boards such as some NAS and embedded devices) and CONFIG_NET_SHAPER enabled. The sources do not say which kernel versions or boards are affected, and systems without this driver or without that option are not affected by this crash.
No product ranges from the sources yet.
CONFIG_NET_SHAPER=y and whether the board uses the mv643xx_eth driver (lsmod | grep mv643xx or grep -i mv643xx /proc/modules)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
net: mv643xx: move setting of netops to fix crash
mv643xx_eth_probe() connects the PHY before dev->netdev_ops is assigned. phy_attach_direct() -> phy_link_topo_add_phy() reads dev->netdev_ops through netdev_need_ops_lock() since the commit in question, so probing crashes with a NULL pointer dereference when CONFIG_NET_SHAPER is enabled.
Assign netdev_ops before the PHY attach, as was done for emac in commit 7c9f391ec89c ("net: emac: move setting of netops to fix crash").
This page as .md · .json · in your agent: get_signal("CVE-2026-99197")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.