CVE-2026-31736

net: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled

Published May 1, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

net: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled

If the gmac0 is disabled, the precheck for a valid ingress device will
cause a NULL pointer deref and crash the system. This happens because
eth->netdev[0] will be NULL but the code will directly try to access
netdev_ops.

Instead of just checking for the first net_device, it must be checked if
any of the mtk_eth net_devices is matching the netdev_ops of the ingress
device.

Analysis

Technical impact

The Linux kernel Ethernet driver for MediaTek (mtk_ppe) incorrectly accesses a null pointer when the first network device gmac0 is disabled, leading to a kernel crash. This null dereference results in a denial‑of‑service condition and is classified as CWE‑476.

Affected Systems

All Linux kernel installations that include the mtk_ppe driver are affected. No specific release numbers are listed, so any kernel containing this code path remains vulnerable until patched. The vendor is Linux.

Risk and Exploitability

The flaw is a pure denial‑of‑service with no authentication or privilege requirements. The CVSS score of 5.5 indicates a moderate severity. The EPSS score is < 1% and the vulnerability is not listed in KEV. The risk remains high because a straightforward trigger such as disabling gmac0 or manipulating network configuration will crash the host, disrupting service.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`73cfd947dbdb25ef9863ac49c4596a7d53ad4025`	affected	< 0b832aad33e6f160fda310f0306a6483d85e9d6e
`73cfd947dbdb25ef9863ac49c4596a7d53ad4025`	affected	< 5dff799c677152dde963c3917bacd9127b03e145
`73cfd947dbdb25ef9863ac49c4596a7d53ad4025`	affected	< 7b2380f0a0e374010c1a4a13203511b9dee5b166
`73cfd947dbdb25ef9863ac49c4596a7d53ad4025`	affected	< 976ff48c2ac6e6b25b01428c9d7997bcd0fb2949

Linux

affected

Version	Status	Constraints
`6.11`	affected	—
`0`	unaffected	< 6.11
`6.12.81`	unaffected	≤ 6.12.*
`6.18.22`	unaffected	≤ 6.18.*
`6.19.12`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc2::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc3::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc4::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc5::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc6::::::

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[73cfd947dbdb25ef9863ac49c4596a7d53ad4025,0b832aad33e6f160fda310f0306a6483d85e9d6e)`	affected	code_commit	—
`[73cfd947dbdb25ef9863ac49c4596a7d53ad4025,5dff799c677152dde963c3917bacd9127b03e145)`	affected	code_commit	—
`[73cfd947dbdb25ef9863ac49c4596a7d53ad4025,7b2380f0a0e374010c1a4a13203511b9dee5b166)`	affected	code_commit	—
`[73cfd947dbdb25ef9863ac49c4596a7d53ad4025,976ff48c2ac6e6b25b01428c9d7997bcd0fb2949)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.11`	affected	semver	—
`[0,6.11)`	unaffected	semver	—
`[6.12.81,6.13.0)`	unaffected	semver	—
`[6.18.22,6.19.0)`	unaffected	semver	—
`[6.19.12,6.20.0)`	unaffected	semver	—
`[7.0,*]`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply a Linux kernel update that includes the mtk_ppe null‑dereference patch referenced in the listed commits.
If an update is not available, avoid disabling gmac0; keep the Ethernet device enabled to prevent the null pointer condition from occurring.
As a temporary measure, monitor kernel logs for ‘oops’ or ‘panic’ messages related to mtk_ppe and remediate promptly.

Generated by OpenCVE AI on May 7, 2026 at 18:52 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.122% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0b832aad33e6f160fda310f0306a6483d85e9d6e
https://git.kernel.org/stable/c/5dff799c677152dde963c3917bacd9127b03e145
https://git.kernel.org/stable/c/7b2380f0a0e374010c1a4a13203511b9dee5b166
https://git.kernel.org/stable/c/976ff48c2ac6e6b25b01428c9d7997bcd0fb2949
https://lore.kernel.org/linux-cve-announce/2026050138-CVE-2026-31736-c2a4@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-31736
https://www.cve.org/CVERecord?id=CVE-2026-31736

History

May 7, 2026 5:00 PM Affected versions updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:o:linux:linux_kernel:7.0:rc1:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc2:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc3:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc4:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc5:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc6::::::
Metrics		cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`

May 2, 2026 12:15 AM Added references View changes

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026050138-CVE-2026-31736-c2a4@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-31736 https://www.cve.org/CVERecord?id=CVE-2026-31736

May 2, 2026 12:00 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-476

May 1, 2026 2:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled If the gmac0 is disabled, the precheck for a valid ingress device will cause a NULL pointer deref and crash the system. This happens because eth->netdev[0] will be NULL but the code will directly try to access netdev_ops. Instead of just checking for the first net_device, it must be checked if any of the mtk_eth net_devices is matching the netdev_ops of the ingress device.
Title		net: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0b832aad33e6f160fda310f0306a6483d85e9d6e https://git.kernel.org/stable/c/5dff799c677152dde963c3917bacd9127b03e145 https://git.kernel.org/stable/c/7b2380f0a0e374010c1a4a13203511b9dee5b166 https://git.kernel.org/stable/c/976ff48c2ac6e6b25b01428c9d7997bcd0fb2949