CVE-2026-98008net: macb: fix NULL pointer dereference on unbind with fixed-link
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: net: macb: fix NULL pointer dereference on unbind with fixed-link When the device tree describes a fixed-link and has no "mdio" child node, macb_mii_init() returns early without allocating the MDIO bus, leaving bp->mii_bus as NULL. Two cleanup paths then dereference this NULL bus: 1. On driver unbind, macb_remove() unconditionally calls mdiobus_unregister(bp->mii_bus), which oopses: Unable to handle kernel NULL pointer dereference at virtual address 00000000000004a8 pc : mdiobus_unregister+0x14/0xa4 lr : macb_remove+0x38/0xa4 Call trace: mdiobus_unregister+0x14/0xa4 (P) macb_remove+0x38/0xa4 platform_remove+0x20/0x30 device_release_driver_internal+0x1c8/0x224 unbind_store+0xb4/0xbc 2. On the probe error path in macb_probe(), reached when macb_mii_init() has succeeded but a subsequent step fails, the err_out_unregister_mdio label runs the same unconditional cleanup. mdiobus_unregister() and mdiobus_free() do not guard against a NULL bus, so guard the calls in both macb_remove() and the probe error path.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 3, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 831e19e565b5210930fa183730071f8290c61263 before afa224cabc0132ca414b9141b1a919ca2d318cd0; 81db1e52848694761a1aa162ce76198af9964ed8 builds before 054ad8e66025eb4778d840bef80c270646cebcd2; from d0c3601f2c4e12e7689b0f46ebc17525250ea8c3 before f737d999fcb8f276d77b01ea4c2016ee01dad19b; from d0c3601f2c4e12e7689b0f46ebc17525250ea8c3 before 5710f6a74f63cbba0e15cd75917234916181c9d4; from d0c3601f2c4e12e7689b0f46ebc17525250ea8c3 before edb39c7666bb3924da761dfb417db85c1e5d8ad3; from d0c3601f2c4e12e7689b0f46ebc17525250ea8c3 before 38b6be101006d3e7af972999f45d4f1e8250587a; cafa5942bd2df3d80e3eeb2deb4bc050f7761f3d; c81dcaa9cd0b66816c2ecb6c5df0b6afde9c7da5; and 6 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/afa224cabc0132ca414b9141b1a919ca2d318cd0
- https://git.kernel.org/stable/c/054ad8e66025eb4778d840bef80c270646cebcd2
- https://git.kernel.org/stable/c/f737d999fcb8f276d77b01ea4c2016ee01dad19b
- https://git.kernel.org/stable/c/5710f6a74f63cbba0e15cd75917234916181c9d4
- https://git.kernel.org/stable/c/edb39c7666bb3924da761dfb417db85c1e5d8ad3
- https://git.kernel.org/stable/c/38b6be101006d3e7af972999f45d4f1e8250587a
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.