Live › vulnerability › CVE-2026-99200
Go to dashboardIn the Linux kernel's HiSilicon hisi_femac Ethernet driver, the PHY is attached before the net device operations are assigned, so probing the device dereferences a NULL pointer when CONFIG_NET_SHAPER is enabled. The result is a kernel panic at boot or driver load, a denial of service rather than code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 11:32 UTC. All times on this page are UTC.
Only systems running a Linux kernel with the HiSilicon hisi_femac Ethernet driver (typically HiSilicon ARM SoC boards) and CONFIG_NET_SHAPER enabled are at risk of the probe crash. Servers and desktops without that hardware and driver can skip it.
No product ranges from the sources yet.
lsmod | grep hisi_femac or dmesg | grep -i femacgrep CONFIG_NET_SHAPER /boot/config-$(uname -r)uname -rEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
net: hisilicon: hisi_femac: Move setting of netops to fix crash
hisi_femac_drv_probe() connects the PHY before dev->netdev_ops is assigned. phy_attach_direct() -> phy_link_topo_add_phy() reads dev->netdev_ops through netdev_need_ops_lock() since the commit in question, so probing crashes with a NULL pointer dereference when CONFIG_NET_SHAPER is enabled.
phy_link_topo_add_phy from phy_attach_direct+0xec/0x37c of_phy_get_and_connect from hisi_femac_drv_probe+0x1f4/0x558 Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
Assign netdev_ops before the PHY attach, as was done for emac in commit 7c9f391ec89c ("net: emac: move setting of netops to fix crash").
This page as .md · .json · in your agent: get_signal("CVE-2026-99200")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.