CVE-2026-98796 - Vulnerability Details

- net: ethernet: mtk_eth_soc: allocate dummy netdev sooner

Description

In the Linux kernel, the following vulnerability has been resolved:

net: ethernet: mtk_eth_soc: allocate dummy netdev sooner

The RX rings and the shared NAPI are carried by an internal "dummy" netdev
(eth->dummy_dev). mtk_probe() creates that dummy device, and adds the
shared tx/rx NAPI to it, only after the MAC netdevs have been registered.
That order has been there since the MT7623 support was added and leaves a
window in which the netdevs are visible to the network core before the
shared NAPI and the dummy device exist.

If anything brings the first netdev up during that window (e.g. netifd
opening the WAN link the instant the interface is registered), the
first-open path runs without them. On NETSYS v2 and later SoCs
mtk_rx_alloc() -> __xdp_rxq_info_reg() then dereferences eth->dummy_dev ==
NULL:

WARNING: CPU: ... Missing net_device from driver

in net/core/xdp.c and mtk_open() fails with -ENODEV. On NETSYS v1 SoCs
(MT7621/MT7622/MT7623/MT7629) there is no page pool, so the same open
instead calls napi_enable() on a napi_struct that netif_napi_add() has not
initialised yet and dereferences a NULL napi->dev.

Allocate the dummy netdev and add the shared tx/rx NAPI to it before the
register_netdev() loop. Both the dummy-allocation failure and a
register_netdev() failure now unwind through mtk_unreg_dev(), which
unregisters the net_device notifiers and the netdevs registered so far,
stopping a concurrently-opened netdev (ndo_stop) and its NAPI before the
dummy carrier is freed.

A netdev that opened during the window can also have queued the
frame-engine reset worker (via the tx watchdog or phylink), so the probe
error path now cancels eth->pending_work before freeing the shared state,
as mtk_cleanup() already does on remove.

Published: 2026-10-18

Score: 4.1 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability is a null pointer dereference caused by a race condition between the allocation of a dummy network device and the registration of other network interfaces. When a device is brought up during a brief window before the dummy netdev and its shared NAPI are initialized, the driver dereferences a null pointer, resulting in a warning and a failure to open the interface.

Affected Systems

Linux kernel builds that include the MediaTek mtk_eth_soc Ethernet driver, particularly on NetSys v1 and v2 SoCs such as MT7621, MT7622, MT7623, and MT7629, are affected. Any kernel version prior to the commit that allocates the dummy netdev early is vulnerable.

Risk and Exploitability

Although the CVSS score of 4.1 indicates low severity, the vulnerability can still cause a denial of service by dereferencing a null pointer when a netdev is brought up during the insecure window before the dummy netdev and its NAPI are initialized. The EPSS score of <1% suggests a very low probability of exploitation in the wild, and the vulnerability is not listed in CISA KEV. Exploitation would likely require privileged local access or control over the system’s initial network configuration; a remote attacker would need to gain local privileges first. Therefore, while the impact is limited to service interruption, patching the kernel is the recommended mitigation.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`656e705243fd0c2864b89634ea16ed444ef64dc6`	affected	< efc91ab1d97bd991faf50baa0ead35029f341eb9
`656e705243fd0c2864b89634ea16ed444ef64dc6`	affected	< 42001839e425b2564b7297be579073a13a8fddf6
`656e705243fd0c2864b89634ea16ed444ef64dc6`	affected	< 82be3d08de9e14d5aed72377f051adb4f09fd540
`656e705243fd0c2864b89634ea16ed444ef64dc6`	affected	< 17eafd74de5a31e30361420a2e3ebf64186b77e5
`656e705243fd0c2864b89634ea16ed444ef64dc6`	affected	< 6f0c2c4f5e7143eba75153ecc8af3a03f7b6a98b

Linux

affected

Version	Status	Constraints
`4.6`	affected	—
`0`	unaffected	< 4.6
`6.6.160`	unaffected	≤ 6.6.*
`6.12.113`	unaffected	≤ 6.12.*
`6.18.56`	unaffected	≤ 6.18.*
`7.2.10`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[656e705243fd0c2864b89634ea16ed444ef64dc6,42001839e425b2564b7297be579073a13a8fddf6)`	affected	code_commit	—
`[656e705243fd0c2864b89634ea16ed444ef64dc6,82be3d08de9e14d5aed72377f051adb4f09fd540)`	affected	code_commit	—
`[656e705243fd0c2864b89634ea16ed444ef64dc6,17eafd74de5a31e30361420a2e3ebf64186b77e5)`	affected	code_commit	—
`[656e705243fd0c2864b89634ea16ed444ef64dc6,6f0c2c4f5e7143eba75153ecc8af3a03f7b6a98b)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.6`	affected	generic	—
`[0,4.6)`	unaffected	generic	—
`[6.12.113,6.13.0)`	unaffected	semver	—
`[6.18.56,6.19.0)`	unaffected	semver	—
`[7.2.10,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the upstream commit that allocates the dummy netdev early; verify the presence of the commit 17eafd74de5a31e30361420a2e3ebf64186b77e5 or later.
Configure the system so that network interfaces do not automatically bring up during boot; for example, disable auto‑up on boot or add a short startup script that delays interface activation until the kernel is fully initialized.
Monitor kernel logs for the message "Missing net_device from driver"; if the warning appears, treat it as an indicator that the race window might still be present and apply the patch promptly.

Generated by OpenCVE AI on October 24, 2026 at 01:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4850-1	linux-6.12 security update

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00168.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98796.mbox
https://git.kernel.org/stable/c/17eafd74de5a31e30361420a2e3ebf64186b77e5
https://git.kernel.org/stable/c/42001839e425b2564b7297be579073a13a8fddf6
https://git.kernel.org/stable/c/6f0c2c4f5e7143eba75153ecc8af3a03f7b6a98b
https://git.kernel.org/stable/c/82be3d08de9e14d5aed72377f051adb4f09fd540
https://git.kernel.org/stable/c/efc91ab1d97bd991faf50baa0ead35029f341eb9
https://nvd.nist.gov/vuln/detail/CVE-2026-98796
https://www.cve.org/CVERecord?id=CVE-2026-98796

History

Sat, 24 Oct 2026 00:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98796.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98796 https://www.cve.org/CVERecord?id=CVE-2026-98796
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Wed, 21 Oct 2026 13:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/efc91ab1d97bd991faf50baa0ead35029f341eb9

Sun, 18 Oct 2026 22:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Sun, 18 Oct 2026 16:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: allocate dummy netdev sooner The RX rings and the shared NAPI are carried by an internal "dummy" netdev (eth->dummy_dev). mtk_probe() creates that dummy device, and adds the shared tx/rx NAPI to it, only after the MAC netdevs have been registered. That order has been there since the MT7623 support was added and leaves a window in which the netdevs are visible to the network core before the shared NAPI and the dummy device exist. If anything brings the first netdev up during that window (e.g. netifd opening the WAN link the instant the interface is registered), the first-open path runs without them. On NETSYS v2 and later SoCs mtk_rx_alloc() -> __xdp_rxq_info_reg() then dereferences eth->dummy_dev == NULL: WARNING: CPU: ... Missing net_device from driver in net/core/xdp.c and mtk_open() fails with -ENODEV. On NETSYS v1 SoCs (MT7621/MT7622/MT7623/MT7629) there is no page pool, so the same open instead calls napi_enable() on a napi_struct that netif_napi_add() has not initialised yet and dereferences a NULL napi->dev. Allocate the dummy netdev and add the shared tx/rx NAPI to it before the register_netdev() loop. Both the dummy-allocation failure and a register_netdev() failure now unwind through mtk_unreg_dev(), which unregisters the net_device notifiers and the netdevs registered so far, stopping a concurrently-opened netdev (ndo_stop) and its NAPI before the dummy carrier is freed. A netdev that opened during the window can also have queued the frame-engine reset worker (via the tx watchdog or phylink), so the probe error path now cancels eth->pending_work before freeing the shared state, as mtk_cleanup() already does on remove.
Title		net: ethernet: mtk_eth_soc: allocate dummy netdev sooner
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/17eafd74de5a31e30361420a2e3ebf64186b77e5 https://git.kernel.org/stable/c/42001839e425b2564b7297be579073a13a8fddf6 https://git.kernel.org/stable/c/6f0c2c4f5e7143eba75153ecc8af3a03f7b6a98b https://git.kernel.org/stable/c/82be3d08de9e14d5aed72377f051adb4f09fd540

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-18T15:48:40.684Z

Updated: 2026-10-21T12:57:04.919Z

Reserved: 2026-09-25T10:25:14.370Z

Link: CVE-2026-98796

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-18T16:17:33.583

Modified: 2026-10-21T13:21:47.127

Link: CVE-2026-98796

Redhat

Severity : Moderate

Publid Date: 2026-10-18T00:00:00Z

Links: CVE-2026-98796 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-24T01:45:17Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object