Live › vulnerability › CVE-2026-99198
Go to dashboardThe Actions Semi Owl Ethernet driver in the Linux kernel assigns its network operations after connecting the PHY, so probing the device dereferences a NULL pointer when CONFIG_NET_SHAPER is enabled. The result is a kernel crash during driver probe, a denial of service on affected boards.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 11:32 UTC. All times on this page are UTC.
Only systems running the Actions Semi Owl SoC Ethernet driver (owl-emac) with CONFIG_NET_SHAPER enabled, which is typically embedded boards based on that SoC. Servers, desktops and hosts using other NICs are not affected. Teams without that hardware can skip it.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
net: ethernet: actions: Move setting of netops to fix crash
owl_emac_probe() calls owl_emac_phy_init(), which connects the PHY, before netdev->netdev_ops is assigned. phy_attach_direct() -> phy_link_topo_add_phy() reads dev->netdev_ops through netdev_need_ops_lock() since the commit in question, so probing crashes with a NULL pointer dereference when CONFIG_NET_SHAPER is enabled.
Assign netdev_ops before the PHY attach, as was done for emac in commit 7c9f391ec89c ("net: emac: move setting of netops to fix crash").
This page as .md · .json · in your agent: get_signal("CVE-2026-99198")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.