CVE-2026-98620 net: ethernet: mtk_eth_soc: unregister net_devices in case of probe failure
A bug in the MediaTek Ethernet driver causes a kernel crash if device registration fails, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98620?
CVE-2026-98620 is a vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: ethernet: mtk_eth_soc: unregister net_devices in case of probe failure
If register_netdev() fails for one of the MTK_MAX_DEVS devices in mtk_probe(), the error path jumps to err_deinit_ppe, skipping mtk_unreg_dev(). The previously registered net_devices are then freed by mtk_free_dev() while still in NETREG_REGISTERED state, hitting the BUG_ON(dev->reg_state != NETREG_UNREGISTERED).
Route the register_netdev() failure to err_unreg_netdev so the net_devices registered so far are properly unregistered before being freed.
Which versions are affected by CVE-2026-98620?
How do I fix CVE-2026-98620?
Apply the vendor's patch.
Is CVE-2026-98620 being exploited?
There is no known exploitation of CVE-2026-98620 in the wild and no public exploit code.
Sources
Also known as AZL-109046, BELL-CVE-2026-98620, DEBIAN-CVE-2026-98620, GHSA-gfj4-2pq5-q7vj, UBUNTU-CVE-2026-98620.