critical · CVSS v3 9.8

CVE-2026-98620

A critical kernel bug in the MediaTek Ethernet driver (mtk_eth_soc) causes a BUG_ON when register_netdev() fails, potentially leading to a k

Overview

A critical kernel bug in the MediaTek Ethernet driver (mtk_eth_soc) causes a BUG_ON when register_netdev() fails, potentially leading to a kernel panic. The flaw occurs during probe failure handling, leaving net_devices in a registered state before they are freed. This can disrupt network services and overall system stability.

Description

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: unregister net_devices in case of probe failure If register_netdev() fails for one of the MTK_MAX_DEVS devices in mtk_probe(), the error path jumps to err_deinit_ppe, skipping mtk_unreg_dev(). The previously registered net_devices are then freed by mtk_free_dev() while still in NETREG_REGISTERED state, hitting the BUG_ON(dev->reg_state != NETREG_UNREGISTERED). Route the register_netdev() failure to err_unreg_netdev so the net_devices registered so far are properly unregistered before being freed.

Impact

The vulnerability can trigger a kernel panic, resulting in a denial‑of‑service for the affected host. Network interfaces may become unusable until the system is rebooted or the driver is reloaded. Defenders should monitor for unexpected reboots or BUG_ON messages in dmesg. The issue does not provide remote code execution but can be leveraged to destabilize critical infrastructure.

Remediation

Apply the official kernel patch that routes register_netdev() failures to err_unreg_netdev, ensuring proper unregistration before freeing devices. Update to the latest stable kernel release that includes the fix. If immediate patching is not possible, disable the mtk_eth_soc driver or the affected network interfaces until a patch is applied. Monitor system logs for BUG_ON occurrences and verify driver state transitions.

Risk context

Severity is critical with a CVSS v3 score of 9.8. No EPSS data is available, but the high severity indicates a high likelihood of impact if the flaw is present. Defenders should treat this as a high‑priority issue.

Affected products

  • Linux kernel
  • MediaTek Ethernet driver
  • mtk_eth_soc
  • MTK_MAX_DEVS

Scores

Severity
critical
CVSS v2
7.5
CVSS v3
9.8
CVSS v4
—
EPSS
—

kernel denial-of-service media-tek network-driver critical availability

← All CVEs

Related CVEs

critical

CVE-2026-98627

CVE-2026-98627 is a critical flaw in the Linux kernel’s BPF subsystem that allows out‑of‑bounds packet pointer accesses due to incorrect displacement handling. The vulnerability can be triggered by malicious BPF programs, potentially enabling memory corruption or privilege escalation. It was fixed by a kernel commit that corrected the pointer offset logic.

View analysis

critical

CVE-2026-98628

In the Linux kernel, the following vulnerability has been resolved: bpf: Make post-verification instruction rewrites killable After do_check() returns, the verifier runs several instruction rewrite passes. Some of them patch or remove one instruction at a time. Each operation moves the remaining instruction and auxiliary-data arrays and adjusts all branch offsets, making the overall work quadratic in the program length. A privileged loader can submit 131072 unconditional jumps by zero followed by a valid return. Verification finishes quickly, but bpf_opt_remove_nops() then spends a long time removing each jump separately. Since this post-verification work neither checks for signals nor reschedules, a pending SIGKILL cannot terminate the task until the rewrite finishes. Make bpf_patch_insn_data() and verifier_remove_insns() common cancellation and rescheduling points. These helpers run from BPF_PROG_LOAD process context, and bpf_patch_insn_data() can already sleep while reallocating auxiliary data. Report interrupted constant blinding as -EINTR and propagate it through both JIT paths, including kernels that permit interpreter fallback. Other blinding failures retain the existing fallback behavior. This does not reduce the quadratic cost of the rewrite passes, but it makes the work preemptible and allows a killed loader to be torn down promptly.

View analysis

critical

CVE-2026-98634

In the Linux kernel, the following vulnerability has been resolved: scsi: sd_zbc: Reject disks with too many zones sd_zbc_read_zones() computes the number of zones with 64-bit arithmetic and stores the result in the unsigned int nr_zones field of struct zoned_disk_info, silently truncating counts that exceed 32 bits. The truncated count is later used to size per-zone resources, while the device may still report more zones than fit. Moreover, sd_zbc_report_zones() counts the reported zones with a signed int zone_idx, which overflows past INT_MAX. Reject devices reporting more than INT_MAX zones at scan time; such a device is not realistic for any medium that exists today, and accepting it produces inconsistent zone bookkeeping.

View analysis

critical

CVE-2026-98652

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Add missing srcu in kvm_s390_set_irq_state() Like kvm_s390_inject_vcpu(), kvm_s390_set_irq_state() also needs the kvm->srcu or the slots lock when performing the Store status operation. Fix by taking kvm->srcu in kvm_s390_set_irq_state().

View analysis