VulnerabilityPublished 18 Oct 2026Updated 21 Oct 2026

CVE-2026-98796: Linux kernel · net: ethernet: mtk_eth_soc: allocate dummy netdev sooner

Source GCVE Database

Authoritative record:CVE-2026-98796

Not known to be exploited · fixed in efc91ab1d97bd991faf50baa0ead35029f341eb9 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 12:55 UTC

Severity

Medium

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 5% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in efc91ab1d97bd991faf50baa0ead35029f341eb9, 42001839e425b2564b7297be579073a13a8fddf6, 82be3d08de9e14d5aed72377f051adb4f09fd540 +2

Exploitation evidence

Disclosed: evidence found.
CVE published 18 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-vc65-jh42-gc6g

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 656e705243fd0c2864b89634ea16ed444ef64dc6, < efc91ab1d97bd991faf50baa0ead35029f341eb9	Fixed in efc91ab1d97bd991faf50baa0ead35029f341eb9
LinuxLinux	Affected ≥ 656e705243fd0c2864b89634ea16ed444ef64dc6, < 42001839e425b2564b7297be579073a13a8fddf6	Fixed in 42001839e425b2564b7297be579073a13a8fddf6
LinuxLinux	Affected ≥ 656e705243fd0c2864b89634ea16ed444ef64dc6, < 82be3d08de9e14d5aed72377f051adb4f09fd540	Fixed in 82be3d08de9e14d5aed72377f051adb4f09fd540
LinuxLinux	Affected ≥ 656e705243fd0c2864b89634ea16ed444ef64dc6, < 17eafd74de5a31e30361420a2e3ebf64186b77e5	Fixed in 17eafd74de5a31e30361420a2e3ebf64186b77e5
LinuxLinux	Affected ≥ 656e705243fd0c2864b89634ea16ed444ef64dc6, < 6f0c2c4f5e7143eba75153ecc8af3a03f7b6a98b	Fixed in 6f0c2c4f5e7143eba75153ecc8af3a03f7b6a98b
LinuxLinux	Affected =4.6	Fixed in–

AI-suggested

A fix has been implemented that changes the initialization order to allocate the dummy net device and add the shared NAPI before registering MAC net devices. Users should apply the updated Linux kernel version containing this fix. No additional mitigation steps are indicated.

Description

A vulnerability in the Linux kernel's MediaTek Ethernet driver (mtk_eth_soc) was resolved by changing the order of dummy net device allocation. The issue involved a timing window where network devices became visible before a shared NAPI and dummy device were initialized, causing null pointer dereferences and failures when bringing interfaces up. The fix allocates the dummy net device and adds the shared NAPI earlier during initialization, preventing these race conditions and ensuring proper cleanup on failure.

Impact

The vulnerability could cause kernel warnings and failures to open network interfaces due to null pointer dereferences during device initialization. This may disrupt network interface availability and stability on affected MediaTek SoCs. There is no indication of remote code execution or privilege escalation from the provided data.

Summary

The Linux kernel's mtk_eth_soc driver had a race condition where the RX rings and shared NAPI were associated with a dummy net device allocated too late during initialization. This allowed network devices to be brought up before the dummy device and shared NAPI existed, leading to null pointer dereferences in mtk_rx_alloc() and mtk_open(), causing warnings and open failures (-ENODEV). The fix moves dummy net device allocation and shared NAPI addition before registering MAC net devices, and improves error handling to unregister devices and cancel pending work properly on failure.

References

Community reviews

Loading reviews…