CVE-2026-98302

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: fddi: skfp: fix NULL deref when setting the MAC address while down

skfp_ctl_set_mac_address() calls ResetAdapter() unconditionally, without

checking netif_running(). ResetAdapter() first calls card_stop(), which

sets smc->hw.hw_state to STOPPED, and then mac_drv_clear_tx_queue(),

which walks the two transmit queues:

for (i = QUEUE_S; i <= QUEUE_A0; i++) {

queue = smc->hw.fp.tx[i] ;

...

t = queue->tx_curr_get ;

smc->hw.fp.tx[] is only populated by init_tx(), which is reached from

skfp_open() through init_smt() -> init_fddi_driver() -> init_fplus() ->

init_mac() -> init_tx(). The private area is allocated and zeroed by

alloc_fddidev(), so on an interface that has never been brought up both

queue pointers are still NULL. The hw_state test at the top of

mac_drv_clear_tx_queue() does not catch this, because card_stop() has

just set STOPPED; the function proceeds into the loop and dereferences

NULL. ResetAdap

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References