---
id: "CVE-2026-99198"
kind: "vulnerability"
aliases: ["CVE-2026-99198"]
title: "Linux kernel: Actions Owl Ethernet driver crashes on probe with shaper enabled"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["actions-semi-owl", "embedded", "infrastructure", "linux-kernel"]
not_affected_if: ["config-net-shaper-disabled", "no-actions-owl-hardware"]
published_at: "2026-10-28T11:17:40+00:00"
first_seen_at: "2026-10-28T11:32:37+00:00"
updated_at: "2026-10-28T11:34:05+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99198", "first_seen_at": "2026-10-28T11:32:37+00:00"}]
---

# Linux kernel: Actions Owl Ethernet driver crashes on probe with shaper enabled

The Actions Semi Owl Ethernet driver in the Linux kernel assigns its network operations after connecting the PHY, so probing the device dereferences a NULL pointer when CONFIG_NET_SHAPER is enabled. The result is a kernel crash during driver probe, a denial of service on affected boards.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- Move to a kernel build that includes the upstream fix that assigns netdev_ops before the PHY attach in owl_emac_probe (the same change made for emac in commit 7c9f391ec89c). Check your distribution's kernel advisory for the fixed version.

## Timeline

- 2026-10-28T11:32:37+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99198

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

net: ethernet: actions: Move setting of netops to fix crash

owl_emac_probe() calls owl_emac_phy_init(), which connects the PHY,
before netdev->netdev_ops is assigned. phy_attach_direct() ->
phy_link_topo_add_phy() reads dev->netdev_ops through
netdev_need_ops_lock() since the commit in question, so probing crashes
with a NULL pointer dereference when CONFIG_NET_SHAPER is enabled.

Assign netdev_ops before the PHY attach, as was done for emac in commit
7c9f391ec89c ("net: emac: move setting of netops to fix crash").

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_