Buffer Overflow in Linux Kernel Network Subsystem Affecting ICSSM PRUETH Module

CVE-2026-99193

What is CVE-2026-99193?

A vulnerability in the Linux kernel impacts the ICSSM PRUETH networking module due to improper initialization of network operations. The function 'icssm_prueth_netdev_init()' invokes 'of_phy_get_and_connect()' before assigning the 'ndev->netdev_ops' structure. This leads to a null pointer dereference when probing hardware with the CONFIG_NET_SHAPER enabled, resulting in system crashes. The fix involves reordering the initializations to ensure that 'netdev_ops' are set before any PHY attach operations, similar to the adjustments made in a previous commit for the emac driver.

References