CVE-2026-98008 - Vulnerability Details

- net: macb: fix NULL pointer dereference on unbind with fixed-link

Description

In the Linux kernel, the following vulnerability has been resolved:

net: macb: fix NULL pointer dereference on unbind with fixed-link

When the device tree describes a fixed-link and has no "mdio" child
node, macb_mii_init() returns early without allocating the MDIO bus,
leaving bp->mii_bus as NULL.

Two cleanup paths then dereference this NULL bus:

1. On driver unbind, macb_remove() unconditionally calls
mdiobus_unregister(bp->mii_bus), which oopses:

Unable to handle kernel NULL pointer dereference at virtual address 00000000000004a8
pc : mdiobus_unregister+0x14/0xa4
lr : macb_remove+0x38/0xa4
Call trace:
mdiobus_unregister+0x14/0xa4 (P)
macb_remove+0x38/0xa4
platform_remove+0x20/0x30
device_release_driver_internal+0x1c8/0x224
unbind_store+0xb4/0xbc

2. On the probe error path in macb_probe(), reached when
macb_mii_init() has succeeded but a subsequent step fails, the
err_out_unregister_mdio label runs the same unconditional cleanup.

mdiobus_unregister() and mdiobus_free() do not guard against a NULL
bus, so guard the calls in both macb_remove() and the probe error
path.

Published: 2026-09-25

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A premature return in macb_mii_init() for fixed‑link configurations leaves the MDIO bus pointer null, and later cleanup paths dereference this null pointer. The resulting kernel oops crashes the system, yielding a denial of service. This flaw is equivalent to CWE‑476, a NULL pointer dereference in privileged code.

Affected Systems

The vulnerability resides in the Linux kernel’s macb network driver. Any Linux system that has this driver compiled in and configures a fixed‑link device tree without an mdio child node is affected. Specific kernel versions are not listed, so all pre‑patch kernels containing the bug are vulnerable.

Risk and Exploitability

The flaw requires the ability to unload or unbind the macb driver or to trigger a probe failure, which is usually available to users with local access. The CVSS score of 5.5 indicates medium severity, and the EPSS score is < 1%. The vulnerability is not listed in the CISA KEV catalog, but a NULL pointer dereference in privileged kernel driver presents a significant denial‑of‑service risk. The likely attack surface is local exploitation rather than remote, but once triggered the impact is global to the affected machine.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`831e19e565b5210930fa183730071f8290c61263`	affected	< afa224cabc0132ca414b9141b1a919ca2d318cd0
`81db1e52848694761a1aa162ce76198af9964ed8`	affected	< 054ad8e66025eb4778d840bef80c270646cebcd2
`d0c3601f2c4e12e7689b0f46ebc17525250ea8c3`	affected	< f737d999fcb8f276d77b01ea4c2016ee01dad19b
`d0c3601f2c4e12e7689b0f46ebc17525250ea8c3`	affected	< 5710f6a74f63cbba0e15cd75917234916181c9d4
`d0c3601f2c4e12e7689b0f46ebc17525250ea8c3`	affected	< edb39c7666bb3924da761dfb417db85c1e5d8ad3
`d0c3601f2c4e12e7689b0f46ebc17525250ea8c3`	affected	< 38b6be101006d3e7af972999f45d4f1e8250587a
`cafa5942bd2df3d80e3eeb2deb4bc050f7761f3d`	affected	—
`c81dcaa9cd0b66816c2ecb6c5df0b6afde9c7da5`	affected	—
`19088c5378c9fea54e552d8bc7418a3aa1e06990`	affected	—
`6.1.114`	affected	< 6.1.189
`6.6.58`	affected	< 6.6.158
`5.10.228`	affected	< 5.11
`5.15.169`	affected	< 5.16
`6.11.5`	affected	< 6.12

Linux

affected

Version	Status	Constraints
`6.12`	affected	—
`0`	unaffected	< 6.12
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.111`	unaffected	≤ 6.12.*
`6.18.53`	unaffected	≤ 6.18.*
`7.2.7`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[d0c3601f2c4e12e7689b0f46ebc17525250ea8c3,f737d999fcb8f276d77b01ea4c2016ee01dad19b)`	affected	code_commit	—
`[d0c3601f2c4e12e7689b0f46ebc17525250ea8c3,5710f6a74f63cbba0e15cd75917234916181c9d4)`	affected	code_commit	—
`[d0c3601f2c4e12e7689b0f46ebc17525250ea8c3,edb39c7666bb3924da761dfb417db85c1e5d8ad3)`	affected	code_commit	—
`[d0c3601f2c4e12e7689b0f46ebc17525250ea8c3,38b6be101006d3e7af972999f45d4f1e8250587a)`	affected	code_commit	—
`cafa5942bd2df3d80e3eeb2deb4bc050f7761f3d`	affected	code_commit	—
`c81dcaa9cd0b66816c2ecb6c5df0b6afde9c7da5`	affected	code_commit	—
`831e19e565b5210930fa183730071f8290c61263`	affected	code_commit	—
`81db1e52848694761a1aa162ce76198af9964ed8`	affected	code_commit	—
`19088c5378c9fea54e552d8bc7418a3aa1e06990`	affected	code_commit	—
`[5.10.228,5.11)`	affected	semver	—
`[5.15.169,5.16)`	affected	semver	—
`[6.1.114,6.2)`	affected	semver	—
`[6.6.58,6.7)`	affected	semver	—
`[6.11.5,6.12)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.12`	affected	semver	—
`[0,6.12)`	unaffected	generic	—
`[6.12.111,6.12.*]`	unaffected	generic	—
`[6.18.53,6.18.*]`	unaffected	generic	—
`[7.2.7,7.2.*]`	unaffected	generic	—
`[7.3-rc3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest stable Linux kernel that incorporates the macb null‑pointer dereference fix (for example, update to a kernel revision that includes commit 38b6be1 or newer).
If a full kernel upgrade is not immediately feasible, manually apply the patch that surrounds mdiobus_unregister and mdiobus_free with NULL checks in macb_remove and the probe error path, then rebuild and load the modified driver.
Verify that device tree entries for macb devices either include an mdio child node when using a fixed link or disable fixed‑link configurations until the patch is applied.

Generated by OpenCVE AI on September 30, 2026 at 14:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DLA	DLA-4841-1	linux security update
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00173.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98008.mbox
https://git.kernel.org/stable/c/054ad8e66025eb4778d840bef80c270646cebcd2
https://git.kernel.org/stable/c/38b6be101006d3e7af972999f45d4f1e8250587a
https://git.kernel.org/stable/c/5710f6a74f63cbba0e15cd75917234916181c9d4
https://git.kernel.org/stable/c/afa224cabc0132ca414b9141b1a919ca2d318cd0
https://git.kernel.org/stable/c/edb39c7666bb3924da761dfb417db85c1e5d8ad3
https://git.kernel.org/stable/c/f737d999fcb8f276d77b01ea4c2016ee01dad19b
https://nvd.nist.gov/vuln/detail/CVE-2026-98008
https://www.cve.org/CVERecord?id=CVE-2026-98008

History

Sat, 03 Oct 2026 11:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/054ad8e66025eb4778d840bef80c270646cebcd2 https://git.kernel.org/stable/c/afa224cabc0132ca414b9141b1a919ca2d318cd0

Tue, 29 Sep 2026 13:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98008.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98008 https://www.cve.org/CVERecord?id=CVE-2026-98008
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 25 Sep 2026 17:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Fri, 25 Sep 2026 10:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net: macb: fix NULL pointer dereference on unbind with fixed-link When the device tree describes a fixed-link and has no "mdio" child node, macb_mii_init() returns early without allocating the MDIO bus, leaving bp->mii_bus as NULL. Two cleanup paths then dereference this NULL bus: 1. On driver unbind, macb_remove() unconditionally calls mdiobus_unregister(bp->mii_bus), which oopses: Unable to handle kernel NULL pointer dereference at virtual address 00000000000004a8 pc : mdiobus_unregister+0x14/0xa4 lr : macb_remove+0x38/0xa4 Call trace: mdiobus_unregister+0x14/0xa4 (P) macb_remove+0x38/0xa4 platform_remove+0x20/0x30 device_release_driver_internal+0x1c8/0x224 unbind_store+0xb4/0xbc 2. On the probe error path in macb_probe(), reached when macb_mii_init() has succeeded but a subsequent step fails, the err_out_unregister_mdio label runs the same unconditional cleanup. mdiobus_unregister() and mdiobus_free() do not guard against a NULL bus, so guard the calls in both macb_remove() and the probe error path.
Title		net: macb: fix NULL pointer dereference on unbind with fixed-link
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/38b6be101006d3e7af972999f45d4f1e8250587a https://git.kernel.org/stable/c/5710f6a74f63cbba0e15cd75917234916181c9d4 https://git.kernel.org/stable/c/edb39c7666bb3924da761dfb417db85c1e5d8ad3 https://git.kernel.org/stable/c/f737d999fcb8f276d77b01ea4c2016ee01dad19b

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-25T10:23:33.532Z

Updated: 2026-10-19T09:12:13.751Z

Reserved: 2026-09-25T10:19:56.068Z

Link: CVE-2026-98008

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-25T11:17:29.080

Modified: 2026-10-19T10:17:52.177

Link: CVE-2026-98008

Redhat

Severity : Moderate

Publid Date: 2026-09-25T00:00:00Z

Links: CVE-2026-98008 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-30T14:30:18Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object