{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-98796 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-98796 is a vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-98796 and fix it if it is affected.\n\nWhat it is: CVE-2026-98796 is a vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-98796 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-98796/ (Markdown: https://insights.sbomify.com/CVE-2026-98796/index.md)","id":"CVE-2026-98796","markdown":"https://insights.sbomify.com/CVE-2026-98796/index.md","name":"CVE-2026-98796","record":{"aliases":["AZL-109079","BELL-CVE-2026-98796","DEBIAN-CVE-2026-98796","GHSA-vc65-jh42-gc6g","UBUNTU-CVE-2026-98796"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel driver","requires_auth":"none","summary":"A race condition in the MediaTek Ethernet driver causes a null pointer dereference and denial of service if an interface is brought up during probe.","user_interaction":"not_required","vuln_class":"null_dereference"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: mtk_eth_soc: allocate dummy netdev sooner\n\nThe RX rings and the shared NAPI are carried by an internal \"dummy\" netdev\n(eth-\u003edummy_dev). mtk_probe() creates that dummy device, and adds the\nshared tx/rx NAPI to it, only after the MAC netdevs have been registered.\nThat order has been there since the MT7623 support was added and leaves a\nwindow in which the netdevs are visible to the network core before the\nshared NAPI and the dummy device exist.\n\nIf anything brings the first netdev up during that window (e.g. netifd\nopening the WAN link the instant the interface is registered), the\nfirst-open path runs without them. On NETSYS v2 and later SoCs\nmtk_rx_alloc() -\u003e __xdp_rxq_info_reg() then dereferences eth-\u003edummy_dev ==\nNULL:\n\n  WARNING: CPU: ... Missing net_device from driver\n\nin net/core/xdp.c and mtk_open() fails with -ENODEV. On NETSYS v1 SoCs\n(MT7621/MT7622/MT7623/MT7629) there is no page pool, so the same open\ninstead calls napi_enable() on a napi_struct that netif_napi_add() has not\ninitialised yet and dereferences a NULL napi-\u003edev.\n\nAllocate the dummy netdev and add the shared tx/rx NAPI to it before the\nregister_netdev() loop. Both the dummy-allocation failure and a\nregister_netdev() failure now unwind through mtk_unreg_dev(), which\nunregisters the net_device notifiers and the netdevs registered so far,\nstopping a concurrently-opened netdev (ndo_stop) and its NAPI before the\ndummy carrier is freed.\n\nA netdev that opened during the window can also have queued the\nframe-engine reset worker (via the tx watchdog or phylink), so the probe\nerror path now cancels eth-\u003epending_work before freeing the shared state,\nas mtk_cleanup() already does on remove.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"net: ethernet: mtk_eth_soc: allocate dummy netdev sooner","id":"CVE-2026-98796","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"null_dereference","year":"2026"},"n_packages":0,"n_references":5,"next":{"headline":"net: cap skb-\u003equeue_mapping when the tx queue is picked","id":"CVE-2026-98797"},"packages":[],"prev":{"headline":"net: sparx5: skip ptp deinit if init was skipped","id":"CVE-2026-98795"},"products":["Linux"],"published":"2026-10-18","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-21","vendors":["Linux"]},"summary":"A race condition in the MediaTek Ethernet driver causes a null pointer dereference and denial of service if an interface is brought up during probe.","url":"https://insights.sbomify.com/CVE-2026-98796/"}