SB20261022409 - NULL pointer dereference in Linux kernel ethernet mediatek driver

Description

This security bulletin contains information about 1 vulnerability.

1) NULL pointer dereference (CVE-ID: CVE-2026-98796)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by triggering network interface startup failure or a kernel NULL pointer dereference.

The vulnerability exists due to an initialization race in the Linux kernel MediaTek Ethernet driver when a network interface is opened after registration but before the internal dummy network device and shared NAPI structures are initialized. A local privileged user can trigger an interface open during this window to cause a denial of service by accessing the missing dummy device or an uninitialized NAPI device pointer.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/17eafd74de5a31e30361420a2e3ebf64186b77e5
• https://git.kernel.org/stable/c/42001839e425b2564b7297be579073a13a8fddf6
• https://git.kernel.org/stable/c/6f0c2c4f5e7143eba75153ecc8af3a03f7b6a98b
• https://git.kernel.org/stable/c/82be3d08de9e14d5aed72377f051adb4f09fd540
• https://git.kernel.org/stable/c/efc91ab1d97bd991faf50baa0ead35029f341eb9