Linux Kernel Vulnerability Affecting mv643xx Ethernet Driver

CVE-2026-99197

What is CVE-2026-99197?

A vulnerability in the Linux kernel's mv643xx Ethernet driver has been identified that may lead to system instability. The issue arises because the mv643xx_eth_probe() function connects the PHY device before the netdev_ops structure is assigned. As a result, when CONFIG_NET_SHAPER is enabled, this sequence leads to a NULL pointer dereference during probing, causing the system to crash. To address this issue, netdev_ops should be assigned prior to PHY attachment, similar to the corrective measures implemented for the EMAC driver in a previous commit.

References