CVE-2026-80614 net: emac: Fix NULL pointer dereference in emac_probe
A NULL pointer dereference in the Linux kernel EMAC driver allows an attacker to cause a system crash via an early interrupt.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-80614?
CVE-2026-80614 is a high-severity vulnerability in Linux, published on 28 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: emac: Fix NULL pointer dereference in emac_probe
Move devm_request_irq() after devm_platform_ioremap_resource() so that dev->emacp is mapped before the interrupt handler can fire. An early interrupt hitting emac_irq() would dereference the NULL dev->emacp and crash.
Also remove redundant error message. devm_platform_ioremap_resource() already returns an error message with dev_err_probe().
Which versions are affected by CVE-2026-80614?
How do I fix CVE-2026-80614?
Apply the vendor's patch.
Is CVE-2026-80614 being exploited?
There is no known exploitation of CVE-2026-80614 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-80614, DEBIAN-CVE-2026-80614, GHSA-72vm-9gwv-cwmm, UBUNTU-CVE-2026-80614.