CVE-2026-98008

CVE CVE-2026-98008EUVD EUVD-2026-86661Published 2026-09-25T10:23:33.000Z

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: net: macb: fix NULL pointer dereference on unbind with fixed-link When the device tree describes a fixed-link and has no "mdio" child node, macb_mii_init() returns early without allocating the MDIO bus, leaving bp->mii_bus as NULL. Two cleanup paths then dereference this NULL bus: 1. On driver unbind, macb_remove() unconditionally calls mdiobus_unregister(bp->mii_bus), which oopses: Unable to handle kernel NULL pointer dereference at virtual address 00000000000004a8 pc : mdiobus_unregister+0x14/0xa4 lr : macb_remove+0x38/0xa4 Call trace: mdiobus_unregister+0x14/0xa4 (P) macb_remove+0x38/0xa4 platform_remove+0x20/0x30 device_release_driver_internal+0x1c8/0x224 unbind_store+0xb4/0xbc 2. On the probe error path in macb_probe(), reached when macb_mii_init() has succeeded but a subsequent step fails, the err_out_unregister_mdio label runs the same unconditional cleanup. mdiobus_unregister() and mdiobus_free() do not guard against a NULL bus, so guard the calls in both macb_remove() and the probe error path.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

Linux — Linux cafa5942bd2df3d80e3eeb2deb4bc050f7761f3d; 831e19e565b5210930fa183730071f8290c61263; d0c3601f2c4e12e7689b0f46ebc17525250ea8c3 <edb39c7666bb3924da761dfb417db85c1e5d8ad3; 6.12; 5.15.169 <5.16; 19088c5378c9fea54e552d8bc7418a3aa1e06990; 5.10.228 <5.11; patch: 7.2.7; patch: 6.18.53; d0c3601f2c4e12e7689b0f46ebc17525250ea8c3 <38b6be101006d3e7af972999f45d4f1e8250587a; c81dcaa9cd0b66816c2ecb6c5df0b6afde9c7da5; patch: 6.12.111; patch: 0; 81db1e52848694761a1aa162ce76198af9964ed8; 6.1.114 <6.2; 6.6.58 <6.7; 6.11.5 <6.12; patch: 7.3-rc3; d0c3601f2c4e12e7689b0f46ebc17525250ea8c3 <5710f6a74f63cbba0e15cd75917234916181c9d4; d0c3601f2c4e12e7689b0f46ebc17525250ea8c3 <f737d999fcb8f276d77b01ea4c2016ee01dad19b

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

Linux — Linux

Does this concern one of your customers?

This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.

Try it for 28 days

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.