Linux Kernel Ethernet Vulnerability in Aeroflex by The Linux Foundation

CVE-2026-99194

What is CVE-2026-99194?

A vulnerability exists in the Linux kernel affecting the Ethernet driver for Aeroflex. The issue arises during the PHY initialization process, where a NULL pointer dereference can occur due to the improper assignment of network operations before the PHY attachment. Specifically, when CONFIG_NET_SHAPER is enabled, the kernel attempts to access networking operations which have not been set, leading to a system crash. To mitigate this vulnerability, it is essential to ensure that the network operations are assigned prior to any PHY connections, enhancing the stability and security of the network interface.

References