{"id":"CVE-2026-99200","kind":"vulnerability","aliases":["CVE-2026-99200"],"related":[],"title":"Linux kernel: hisi_femac driver crashes on probe with NULL netdev_ops","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hisilicon: hisi_femac: Move setting of netops to fix crash\n\nhisi_femac_drv_probe() connects the PHY before dev->netdev_ops is\nassigned. phy_attach_direct() -> phy_link_topo_add_phy() reads\ndev->netdev_ops through netdev_need_ops_lock() since the commit in\nquestion, so probing crashes with a NULL pointer dereference when\nCONFIG_NET_SHAPER is enabled.\n\n  phy_link_topo_add_phy from phy_attach_direct+0xec/0x37c\n  of_phy_get_and_connect from hisi_femac_drv_probe+0x1f4/0x558\n  Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b\n\nAssign netdev_ops before the PHY attach, as was done for emac in commit\n7c9f391ec89c (\"net: emac: move setting of netops to fix crash\").","summary":"In the Linux kernel's HiSilicon hisi_femac Ethernet driver, the PHY is attached before the net device operations are assigned, so probing the device dereferences a NULL pointer when CONFIG_NET_SHAPER is enabled. The result is a kernel panic at boot or driver load, a denial of service rather than code execution.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","hisilicon-soc","linux-kernel","runtime"],"not_affected_if":["net-shaper-disabled","no-hisi-femac-hardware"],"how_to_check":"- Check whether the hisi_femac driver is in use: `lsmod | grep hisi_femac` or `dmesg | grep -i femac`\n- Check whether CONFIG_NET_SHAPER is enabled: `grep CONFIG_NET_SHAPER /boot/config-$(uname -r)`\n- Check the running kernel version: `uname -r`","fix":"- Move to a Linux kernel release that includes the upstream fix (assigning netdev_ops before the PHY attach, as in the emac fix commit 7c9f391ec89c); exact fixed version: unknown\n- Until patched, avoid enabling CONFIG_NET_SHAPER on hardware using hisi_femac","status":"open","published_at":"2026-10-28T11:17:41+00:00","first_seen_at":"2026-10-28T11:32:37+00:00","triaged_at":"2026-10-28T11:34:03+00:00","updated_at":"2026-10-28T11:34:03+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-28T11:34:03Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a Linux kernel release that includes the upstream fix (assigning netdev_ops before the PHY attach, as in the emac fix commit 7c9f391ec89c); exact fixed version: unknown\n- Until patched, avoid enabling CONFIG_NET_SHAPER on hardware using hisi_femac","reach":"local","title":"Linux kernel: hisi_femac driver crashes on probe with NULL netdev_ops","impact":"low","summary":"In the Linux kernel's HiSilicon hisi_femac Ethernet driver, the PHY is attached before the net device operations are assigned, so probing the device dereferences a NULL pointer when CONFIG_NET_SHAPER is enabled. The result is a kernel panic at boot or driver load, a denial of service rather than code execution.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","hisilicon-soc","embedded"],"confidence":0.7,"needs_auth":"no","worst_case":"kernel panic during driver probe, denial of service at boot","analyst_note":"","how_to_check":"- Check whether the hisi_femac driver is in use: `lsmod | grep hisi_femac` or `dmesg | grep -i femac`\n- Check whether CONFIG_NET_SHAPER is enabled: `grep CONFIG_NET_SHAPER /boot/config-$(uname -r)`\n- Check the running kernel version: `uname -r`","needs_analyst":false,"not_affected_if":["no-hisi-femac-hardware","net-shaper-disabled"],"who_is_affected":"Only systems running a Linux kernel with the HiSilicon hisi_femac Ethernet driver (typically HiSilicon ARM SoC boards) and CONFIG_NET_SHAPER enabled are at risk of the probe crash. Servers and desktops without that hardware and driver can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.0007,"input_tokens":3554,"output_tokens":690,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':160C,172C '-2026':14A,17A '-99200':15A,18A '0x0000000b':183C '7c9f391ec89c':198C 'add':121C,154C 'assign':47B,114C,184C 'attach':40B,116C,158C,190C 'attempt':178C 'boot':69B 'code':79B 'commit':134C,197C 'config':57B,146C 'connect':106C,166C 'crash':6A,101C,139C,207C 'cve':13A,16A 'denial':74B 'derefer':52B,144C 'dev':110C,124C 'devic':44B,51B 'direct':117C,159C 'done':193C 'driver':5A,36B,71B 'drv':104C,170C 'emac':195C,200C 'embed':19B 'enabl':61B,150C 'ethernet':35B 'execut':80B 'exitcod':182C 'femac':4A,34B,94C,103C,169C 'fix':100C,206C 'follow':86C 'get':164C 'hisi':3A,33B,93C,102C,168C 'hisilicon':21B,32B,92C 'hisilicon-soc':20B 'init':181C 'kernel':2A,25B,30B,66B,84C,174C 'kill':180C 'link':119C,152C 'linux':1A,24B,29B,83C 'linux-kernel':23B 'load':72B 'lock':131C 'move':95C,201C 'need':129C 'net':43B,58B,91C,147C,199C 'netdev':11A,111C,125C,128C,185C 'netop':98C,204C 'null':10A,54B,142C 'op':12A,112C,126C,130C,186C 'oper':45B 'panic':67B,175C 'phi':38B,108C,115C,118C,122C,151C,155C,157C,163C,189C 'pointer':55B,143C 'probe':8A,49B,105C,138C,171C 'question':136C 'rather':77B 'read':123C 'resolv':90C 'result':63B 'runtim':26B 'servic':76B 'set':96C,202C 'shaper':59B,148C 'sinc':132C 'soc':22B 'sync':177C 'topo':120C,153C 'vulner':87C 'x1f4/0x558':173C 'xec/0x37c':161C","nicknames":[],"mitigations":[],"who_affected":"Only systems running a Linux kernel with the HiSilicon hisi_femac Ethernet driver (typically HiSilicon ARM SoC boards) and CONFIG_NET_SHAPER enabled are at risk of the probe crash. Servers and desktops without that hardware and driver can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:41+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99200","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99200","severity":null,"published_at":"2026-10-28T11:17:41+00:00","modified_at":"2026-10-28T11:17:41+00:00","first_seen_at":"2026-10-28T11:32:37+00:00","fetched_at":"2026-10-28T11:32:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}