All vulnerabilities
CVE-2026-98008

Linux: net: macb: fix NULL pointer dereference on unbind with fixed-link

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in054ad8e66025eb4778d840bef80c270646cebcd2Also 5710f6a74f63cbba0e15cd75917234916181c9d4, 38b6be101006d3e7af972999f45d4f1e8250587a and 5 moreCVE List
Published25 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

Show all 8 fixed versions

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

net: macb: fix NULL pointer dereference on unbind with fixed-link

When the device tree describes a fixed-link and has no "mdio" child node, macb_mii_init() returns early without allocating the MDIO bus, leaving bp->mii_bus as NULL.

Two cleanup paths then dereference this NULL bus:

  1. On driver unbind, macb_remove() unconditionally calls

mdiobus_unregister(bp->mii_bus), which oopses:

Unable to handle kernel NULL pointer dereference at virtual address 00000000000004a8 pc : mdiobus_unregister+0x14/0xa4 lr : macb_remove+0x38/0xa4 Call trace: mdiobus_unregister+0x14/0xa4 (P) macb_remove+0x38/0xa4 platform_remove+0x20/0x30 device_release_driver_internal+0x1c8/0x224 unbind_store+0xb4/0xbc

  1. On the probe error path in macb_probe(), reached when

macb_mii_init() has succeeded but a subsequent step fails, the err_out_unregister_mdio label runs the same unconditional cleanup.

mdiobus_unregister() and mdiobus_free() do not guard against a NULL bus, so guard the calls in both macb_remove() and the probe error path.

Text from CVE List

Affected versions 22

  • Linuxaffected: 831e19e565b5210930fa183730071f8290c61263 before afa224cabc0132ca414b9141b1a919ca2d318cd0CVE List
  • Linuxaffected: 81db1e52848694761a1aa162ce76198af9964ed8 before 054ad8e66025eb4778d840bef80c270646cebcd2CVE List
  • Linuxaffected: d0c3601f2c4e12e7689b0f46ebc17525250ea8c3 before f737d999fcb8f276d77b01ea4c2016ee01dad19bCVE List
  • Linuxaffected: d0c3601f2c4e12e7689b0f46ebc17525250ea8c3 before 5710f6a74f63cbba0e15cd75917234916181c9d4CVE List
  • Linuxaffected: d0c3601f2c4e12e7689b0f46ebc17525250ea8c3 before edb39c7666bb3924da761dfb417db85c1e5d8ad3CVE List
  • Linuxaffected: d0c3601f2c4e12e7689b0f46ebc17525250ea8c3 before 38b6be101006d3e7af972999f45d4f1e8250587aCVE List
  • Linuxaffected: cafa5942bd2df3d80e3eeb2deb4bc050f7761f3dCVE List
  • Linuxaffected: c81dcaa9cd0b66816c2ecb6c5df0b6afde9c7da5CVE List
  • Linuxaffected: 19088c5378c9fea54e552d8bc7418a3aa1e06990CVE List
  • Linuxaffected: 6.1.114 before 6.1.189CVE List
  • Linuxaffected: 6.6.58 before 6.6.158CVE List
  • Linuxaffected: 5.10.228 before 5.11CVE List
  • Linuxaffected: 5.15.169 before 5.16CVE List
  • Linuxaffected: 6.11.5 before 6.12CVE List
  • Linuxaffected: 6.12CVE List
  • Linuxunaffected: all versions before 6.12CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 6