CVE-2026-31736 - Vulnerability Details

- net: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled

Description

In the Linux kernel, the following vulnerability has been resolved:

net: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled

If the gmac0 is disabled, the precheck for a valid ingress device will
cause a NULL pointer deref and crash the system. This happens because
eth->netdev[0] will be NULL but the code will directly try to access
netdev_ops.

Instead of just checking for the first net_device, it must be checked if
any of the mtk_eth net_devices is matching the netdev_ops of the ingress
device.

Published: 2026-05-01

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel Ethernet driver for MediaTek (mtk_ppe) incorrectly accesses a null pointer when the first network device gmac0 is disabled, leading to a kernel crash. This null dereference results in a denial‑of‑service condition and is classified as CWE‑476.

Affected Systems

All Linux kernel installations that include the mtk_ppe driver are affected. No specific release numbers are listed, so any kernel containing this code path remains vulnerable until patched. The vendor is Linux.

Risk and Exploitability

The flaw is a pure denial‑of‑service with no authentication or privilege requirements. The EPSS score is not available and the vulnerability is not listed in KEV. The risk remains high because a straightforward trigger such as disabling gmac0 or manipulating network configuration will crash the host, disrupting service.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`73cfd947dbdb25ef9863ac49c4596a7d53ad4025`	affected	< 0b832aad33e6f160fda310f0306a6483d85e9d6e
`73cfd947dbdb25ef9863ac49c4596a7d53ad4025`	affected	< 5dff799c677152dde963c3917bacd9127b03e145
`73cfd947dbdb25ef9863ac49c4596a7d53ad4025`	affected	< 7b2380f0a0e374010c1a4a13203511b9dee5b166
`73cfd947dbdb25ef9863ac49c4596a7d53ad4025`	affected	< 976ff48c2ac6e6b25b01428c9d7997bcd0fb2949

Linux

affected

Version	Status	Constraints
`6.11`	affected	—
`0`	unaffected	< 6.11
`6.12.81`	unaffected	≤ 6.12.*
`6.18.22`	unaffected	≤ 6.18.*
`6.19.12`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[73cfd947dbdb25ef9863ac49c4596a7d53ad4025,0b832aad33e6f160fda310f0306a6483d85e9d6e)`	affected	code_commit	—
`[73cfd947dbdb25ef9863ac49c4596a7d53ad4025,5dff799c677152dde963c3917bacd9127b03e145)`	affected	code_commit	—
`[73cfd947dbdb25ef9863ac49c4596a7d53ad4025,7b2380f0a0e374010c1a4a13203511b9dee5b166)`	affected	code_commit	—
`[73cfd947dbdb25ef9863ac49c4596a7d53ad4025,976ff48c2ac6e6b25b01428c9d7997bcd0fb2949)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.11`	affected	semver	—
`[0,6.11)`	unaffected	semver	—
`[6.12.81,6.13.0)`	unaffected	semver	—
`[6.18.22,6.19.0)`	unaffected	semver	—
`[6.19.12,6.20.0)`	unaffected	semver	—
`[7.0,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply a Linux kernel update that includes the mtk_ppe null‑dereference patch referenced in the listed commits.
If an update is not available, avoid disabling gmac0; keep the Ethernet device enabled to prevent the null pointer condition from occurring.
As a temporary measure, monitor kernel logs for ‘oops’ or ‘panic’ messages related to mtk_ppe and remediate promptly.

Generated by OpenCVE AI on May 1, 2026 at 23:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00023.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0b832aad33e6f160fda310f0306a6483d85e9d6e
https://git.kernel.org/stable/c/5dff799c677152dde963c3917bacd9127b03e145
https://git.kernel.org/stable/c/7b2380f0a0e374010c1a4a13203511b9dee5b166
https://git.kernel.org/stable/c/976ff48c2ac6e6b25b01428c9d7997bcd0fb2949
https://lore.kernel.org/linux-cve-announce/2026050138-CVE-2026-31736-c2a4@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-31736
https://www.cve.org/CVERecord?id=CVE-2026-31736

History

Sat, 02 May 2026 00:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026050138-CVE-2026-31736-c2a4@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-31736 https://www.cve.org/CVERecord?id=CVE-2026-31736

Sat, 02 May 2026 00:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Fri, 01 May 2026 14:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled If the gmac0 is disabled, the precheck for a valid ingress device will cause a NULL pointer deref and crash the system. This happens because eth->netdev[0] will be NULL but the code will directly try to access netdev_ops. Instead of just checking for the first net_device, it must be checked if any of the mtk_eth net_devices is matching the netdev_ops of the ingress device.
Title		net: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0b832aad33e6f160fda310f0306a6483d85e9d6e https://git.kernel.org/stable/c/5dff799c677152dde963c3917bacd9127b03e145 https://git.kernel.org/stable/c/7b2380f0a0e374010c1a4a13203511b9dee5b166 https://git.kernel.org/stable/c/976ff48c2ac6e6b25b01428c9d7997bcd0fb2949

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-05-01T14:14:33.583Z

Updated: 2026-05-01T14:14:33.583Z

Reserved: 2026-03-09T15:48:24.137Z

Link: CVE-2026-31736

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-05-01T15:16:36.240

Modified: 2026-05-01T15:24:14.893

Link: CVE-2026-31736

Redhat

Severity :

Publid Date: 2026-05-01T00:00:00Z

Links: CVE-2026-31736 - Bugzilla

OpenCVE Enrichment

Updated: 2026-05-01T23:45:09Z

Weaknesses

CWE-476

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object