net: macb: fix NULL pointer dereference on unbind with fixed-link
Summary
| CVE | CVE-2026-98008 |
|---|
| State | PUBLISHED |
|---|
| Assigner | Linux |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2026-09-25 11:17:29 UTC |
|---|
| Updated | 2026-09-25 11:17:29 UTC |
|---|
| Description | In the Linux kernel, the following vulnerability has been resolved:
net: macb: fix NULL pointer dereference on unbind with fixed-link
When the device tree describes a fixed-link and has no "mdio" child
node, macb_mii_init() returns early without allocating the MDIO bus,
leaving bp->mii_bus as NULL.
Two cleanup paths then dereference this NULL bus:
1. On driver unbind, macb_remove() unconditionally calls
mdiobus_unregister(bp->mii_bus), which oopses:
Unable to handle kernel NULL pointer dereference at virtual address 00000000000004a8
pc : mdiobus_unregister+0x14/0xa4
lr : macb_remove+0x38/0xa4
Call trace:
mdiobus_unregister+0x14/0xa4 (P)
macb_remove+0x38/0xa4
platform_remove+0x20/0x30
device_release_driver_internal+0x1c8/0x224
unbind_store+0xb4/0xbc
2. On the probe error path in macb_probe(), reached when
macb_mii_init() has succeeded but a subsequent step fails, the
err_out_unregister_mdio label runs the same unconditional cleanup.
mdiobus_unregister() and mdiobus_free() do not guard against a NULL
bus, so guard the calls in both macb_remove() and the probe error
path. |
|---|
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|
| CNA |
Linux |
Linux |
affected d0c3601f2c4e12e7689b0f46ebc17525250ea8c3 f737d999fcb8f276d77b01ea4c2016ee01dad19b git |
Not specified |
| CNA |
Linux |
Linux |
affected d0c3601f2c4e12e7689b0f46ebc17525250ea8c3 5710f6a74f63cbba0e15cd75917234916181c9d4 git |
Not specified |
| CNA |
Linux |
Linux |
affected d0c3601f2c4e12e7689b0f46ebc17525250ea8c3 edb39c7666bb3924da761dfb417db85c1e5d8ad3 git |
Not specified |
| CNA |
Linux |
Linux |
affected d0c3601f2c4e12e7689b0f46ebc17525250ea8c3 38b6be101006d3e7af972999f45d4f1e8250587a git |
Not specified |
| CNA |
Linux |
Linux |
affected cafa5942bd2df3d80e3eeb2deb4bc050f7761f3d git |
Not specified |
| CNA |
Linux |
Linux |
affected c81dcaa9cd0b66816c2ecb6c5df0b6afde9c7da5 git |
Not specified |
| CNA |
Linux |
Linux |
affected 831e19e565b5210930fa183730071f8290c61263 git |
Not specified |
| CNA |
Linux |
Linux |
affected 81db1e52848694761a1aa162ce76198af9964ed8 git |
Not specified |
| CNA |
Linux |
Linux |
affected 19088c5378c9fea54e552d8bc7418a3aa1e06990 git |
Not specified |
| CNA |
Linux |
Linux |
affected 5.10.228 5.11 semver |
Not specified |
| CNA |
Linux |
Linux |
affected 5.15.169 5.16 semver |
Not specified |
| CNA |
Linux |
Linux |
affected 6.1.114 6.2 semver |
Not specified |
| CNA |
Linux |
Linux |
affected 6.6.58 6.7 semver |
Not specified |
| CNA |
Linux |
Linux |
affected 6.11.5 6.12 semver |
Not specified |
| CNA |
Linux |
Linux |
affected 6.12 |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.12 semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.12.111 6.12.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.18.53 6.18.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 7.2.7 7.2.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 7.3-rc3 * original_commit_for_fix |
Not specified |
References
| Reference | Source | Link | Tags |
|---|
| git.kernel.org/stable/c/38b6be101006d3e7af972999f45d4f1e8250587a |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/edb39c7666bb3924da761dfb417db85c1e5d8ad3 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/5710f6a74f63cbba0e15cd75917234916181c9d4 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/f737d999fcb8f276d77b01ea4c2016ee01dad19b |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.