CVE-2026-98796

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: ethernet: mtk_eth_soc: allocate dummy netdev sooner

The RX rings and the shared NAPI are carried by an internal "dummy" netdev

(eth->dummy_dev). mtk_probe() creates that dummy device, and adds the

shared tx/rx NAPI to it, only after the MAC netdevs have been registered.

That order has been there since the MT7623 support was added and leaves a

window in which the netdevs are visible to the network core before the

shared NAPI and the dummy device exist.

If anything brings the first netdev up during that window (e.g. netifd

opening the WAN link the instant the interface is registered), the

first-open path runs without them. On NETSYS v2 and later SoCs

mtk_rx_alloc() -> __xdp_rxq_info_reg() then dereferences eth->dummy_dev ==

NULL:

WARNING: CPU: ... Missing net_device from driver

in net/core/xdp.c and mtk_open() fails with -ENODEV. On NETSYS v1 SoCs

(MT7621/MT7622/MT7623/MT7629) there is no page pool, so the sa

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References