CVE-2026-99197

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99197", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.400Z", "datePublished": "2026-10-28T10:35:52.987Z", "dateUpdated": "2026-10-28T10:35:52.987Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-28T10:35:52.987Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mv643xx: move setting of netops to fix crash\n\nmv643xx_eth_probe() connects the PHY before dev->netdev_ops is\nassigned. phy_attach_direct() -> phy_link_topo_add_phy() reads\ndev->netdev_ops through netdev_need_ops_lock() since the commit in\nquestion, so probing crashes with a NULL pointer dereference when\nCONFIG_NET_SHAPER is enabled.\n\nAssign netdev_ops before the PHY attach, as was done for emac in commit\n7c9f391ec89c (\"net: emac: move setting of netops to fix crash\")."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/marvell/mv643xx_eth.c"], "versions": [{"version": "ded86da4bbb78cad74cecc368fee3ae3a296e2ca", "lessThan": "bfb1ca89e9f6efa26c8a4a5b9de46541a222abc9", "status": "affected", "versionType": "git"}, {"version": "ded86da4bbb78cad74cecc368fee3ae3a296e2ca", "lessThan": "a3eef3d2cca032d8768b5eb07aab0f46b79bfd8a", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/marvell/mv643xx_eth.c"], "versions": [{"version": "7.2", "status": "affected"}, {"version": "0", "lessThan": "7.2", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.13", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.2", "versionEndExcluding": "7.2.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.2", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/bfb1ca89e9f6efa26c8a4a5b9de46541a222abc9"}, {"url": "https://git.kernel.org/stable/c/a3eef3d2cca032d8768b5eb07aab0f46b79bfd8a"}], "title": "net: mv643xx: move setting of netops to fix crash", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/marvell/mv643xx_eth.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "bfb1ca89e9f6efa26c8a4a5b9de46541a222abc9", "status": "affected", "version": "ded86da4bbb78cad74cecc368fee3ae3a296e2ca", "versionType": "git"}, {"lessThan": "a3eef3d2cca032d8768b5eb07aab0f46b79bfd8a", "status": "affected", "version": "ded86da4bbb78cad74cecc368fee3ae3a296e2ca", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/marvell/mv643xx_eth.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.2"}, {"lessThan": "7.2", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.13", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mv643xx: move setting of netops to fix crash\n\nmv643xx_eth_probe() connects the PHY before dev->netdev_ops is\nassigned. phy_attach_direct() -> phy_link_topo_add_phy() reads\ndev->netdev_ops through netdev_need_ops_lock() since the commit in\nquestion, so probing crashes with a NULL pointer dereference when\nCONFIG_NET_SHAPER is enabled.\n\nAssign netdev_ops before the PHY attach, as was done for emac in commit\n7c9f391ec89c (\"net: emac: move setting of netops to fix crash\")."}], "id": "CVE-2026-99197", "lastModified": "2026-10-28T11:17:40.777", "metrics": {}, "published": "2026-10-28T11:17:40.777", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a3eef3d2cca032d8768b5eb07aab0f46b79bfd8a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bfb1ca89e9f6efa26c8a4a5b9de46541a222abc9"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: net: mv643xx: move setting of netops to fix crash", "id": "2562744", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2562744"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet: mv643xx: move setting of netops to fix crash\nmv643xx_eth_probe() connects the PHY before dev->netdev_ops is\nassigned. phy_attach_direct() -> phy_link_topo_add_phy() reads\ndev->netdev_ops through netdev_need_ops_lock() since the commit in\nquestion, so probing crashes with a NULL pointer dereference when\nCONFIG_NET_SHAPER is enabled.\nAssign netdev_ops before the PHY attach, as was done for emac in commit\n7c9f391ec89c (\"net: emac: move setting of netops to fix crash\").", "A flaw was found in the Linux kernel's Marvell mv643xx Ethernet driver. This flaw can result in a Denial of Service (DoS) by causing the system to crash during device initialization. The issue occurs because the driver attempts to attach the physical network interface before assigning its internal operations table. When network traffic shaping features are enabled, this improper ordering triggers a null pointer dereference that halts the kernel during device probing."], "name": "CVE-2026-99197", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99197\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99197\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99197.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ded86da4bbb78cad74cecc368fee3ae3a296e2ca,bfb1ca89e9f6efa26c8a4a5b9de46541a222abc9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ded86da4bbb78cad74cecc368fee3ae3a296e2ca,a3eef3d2cca032d8768b5eb07aab0f46b79bfd8a)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,7.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.13,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ded86da4bbb78cad74cecc368fee3ae3a296e2ca,bfb1ca89e9f6efa26c8a4a5b9de46541a222abc9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ded86da4bbb78cad74cecc368fee3ae3a296e2ca,a3eef3d2cca032d8768b5eb07aab0f46b79bfd8a)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,7.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.13,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-28T13:00:15.528747+00:00", "updated": "2026-10-29T16:30:14.705155+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}