HIGH Introduced in 6.12
emac ProbeIrq Deref
CVE-2026-80614
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
KernelScan AI5.1MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: net: emac: Fix NULL pointer dereference in emac_probe Move devm_request_irq() after devm_platform_ioremap_resource() so that dev->emacp is mapped before the interrupt handler can fire. An early interrupt hitting emac_irq() would dereference the NULL dev->emacp and crash. Also remove redundant error message. devm_platform_ioremap_resource() already returns an error message with dev_err_probe().
02KernelScan AI Analysis
Risk summary
A race condition in the IBM EMAC Ethernet driver's probe function can cause a kernel crash if a hardware interrupt fires before the device's I/O memory is mapped. The bug affects PowerPC and embedded platforms using the IBM EMAC controller. An attacker who can deliver network traffic to the EMAC port during the narrow probe window (e.g., at boot) may trigger the crash remotely.
Vulnerability analysis
During device probe, the IBM EMAC Ethernet driver registers its interrupt handler before mapping the device's I/O memory registers. If a hardware interrupt arrives in that window, the handler dereferences the still-NULL I/O base pointer and crashes the kernel. The fix reorders the probe sequence so that I/O memory is mapped first and the pointer is valid before the interrupt is enabled. This driver is for the IBM EMAC controller found on PowerPC embedded platforms; the crash can be triggered by any interrupt during the probe window, including interrupts potentially caused by incoming network traffic on the EMAC Ethernet port.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 6.12 | 6.18.40 | a103cdb0681e |
| 7.1 | 6.12 | 7.1.5 | 44068b6863fb |
| mainline | 6.12 | 7.2 | f623d38fe6c4 |