NULL Pointer Dereference in Linux Kernel Due to Improper Network Operations Handling

CVE-2026-99199

What is CVE-2026-99199?

A vulnerability exists in the Linux kernel that may result in a system crash due to a NULL pointer dereference in the hip04_mac_probe() function. This occurs when the function calls of_phy_connect() before properly assigning the netdev_ops field. Under CONFIG_NET_SHAPER, this improper sequence leads to a crash as the probing operation attempts to access an uninitialized field. To remediate this issue, the netdev_ops should be assigned prior to the PHY attachment, improving the stability and reliability of the affected network operations.

References