CVE-2026-98008

Overview

CVE-2026-98008 is a Linux kernel NULL pointer dereference in the macb Ethernet driver when a device tree uses fixed-link without an MDIO child node. The driver can leave bp->mii_bus NULL and later call mdiobus_unregister() during unbind or probe error cleanup. This matters because it can crash the kernel on affected embedded or ARM systems using MACB networking.

Description

In the Linux kernel, the following vulnerability has been resolved: net: macb: fix NULL pointer dereference on unbind with fixed-link When the device tree describes a fixed-link and has no "mdio" child node, macb_mii_init() returns early without allocating the MDIO bus, leaving bp->mii_bus as NULL. Two cleanup paths then dereference this NULL bus: 1. On driver unbind, macb_remove() unconditionally calls mdiobus_unregister(bp->mii_bus), which oopses: Unable to handle kernel NULL pointer dereference at virtual address 00000000000004a8 pc : mdiobus_unregister+0x14/0xa4 lr : macb_remove+0x38/0xa4 Call trace: mdiobus_unregister+0x14/0xa4 (P) macb_remove+0x38/0xa4 platform_remove+0x20/0x30 device_release_driver_internal+0x1c8/0x224 unbind_store+0xb4/0xbc 2. On the probe error path in macb_probe(), reached when macb_mii_init() has succeeded but a subsequent step fails, the err_out_unregister_mdio label runs the same unconditional cleanup. mdiobus_unregister() and mdiobus_free() do not guard against a NULL bus, so guard the calls in both macb_remove() and the probe error path.

Impact

Confidentiality and integrity are not directly indicated; the primary impact is availability through a kernel oops or panic. Systems using the macb driver with fixed-link device-tree configurations and no MDIO child node are affected. Local actors or maintenance operations that unbind the driver, or a failed probe path, can trigger the crash. This is most relevant to embedded, automotive, or industrial devices relying on MACB Ethernet.

Remediation

Apply the kernel patch that guards mdiobus_unregister() and mdiobus_free() against NULL in macb_remove() and the macb_probe() error path. Update the Linux kernel to a release containing the fix, or backport the patch to supported kernels. Until patched, avoid unbinding the macb driver on affected fixed-link systems and validate device-tree configurations to ensure MDIO handling is correct. Monitor kernel logs for macb probe failures or NULL pointer dereference messages and restart affected services or devices if a crash occurs.

Risk context

The CVE is rated medium with CVSS v3 5.5 and no EPSS data is provided. Urgency is moderate: prioritize patching on internet-facing or critical embedded systems, but it is not an active remote code execution issue based on the description.

Affected products

• Linux kernel
• macb Ethernet driver
• Systems with fixed-link MACB devices