CRITICAL Introduced in 4.8
mtk_eth_soc PollController Deref
CVE-2026-80694
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI5.5MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller mtk_handle_irq_rx expects a struct mtk_eth * (matching the request_irq cookie), but mtk_poll_controller incorrectly passed the net_device *. Calling ndo_poll_controller with CONFIG_NET_POLL_CONTROLLER enabled would then crash.
02KernelScan AI Analysis
Risk summary
A type confusion in the MediaTek Ethernet poll controller passes the wrong object to an IRQ handler, causing a kernel crash when netpoll is active. Local users with network configuration privileges can trigger this denial of service on systems using affected MediaTek Ethernet hardware.
Vulnerability analysis
The poll controller callback for the MediaTek Ethernet driver passes a network device object where an Ethernet controller object is expected, so the IRQ handler interprets the wrong memory layout and dereferences invalid fields, crashing the kernel. The fix passes the correct controller object so the handler operates on valid data. This path is reached when netpoll is enabled and active on a system with MediaTek Ethernet hardware, requiring local access and the ability to configure network interfaces.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 4.8 | 6.12.103 | 3bd58ac9ca0c |
| 6.18 | 4.8 | 6.18.44 | 276f1f180f55 |
| 6.6 | 4.8 | 6.6.160 | a9133c4d335e |
| 7.1 | 4.8 | 7.1.8 | 7eb46318d539 |
| mainline | 4.8 | 7.2 | e095f249e220 |
| cip/6.12 | 4.8 | 6.12.104-cip30 | 3bd58ac9ca0c |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.104-cip30 |
| cip/6.1 | Affected — no CIP fix yet (latest 6.1.189-cip61) |
| cip/6.1-rt | Affected — no CIP fix yet (latest 6.1.189-cip61-rt32) |
| cip/5.10 | Affected — no CIP fix yet (latest 5.10.271-cip78) |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |
| cip/4.19 | Affected — no CIP fix yet (latest 4.19.325-cip136) |
| cip/4.19-rt | Affected — no CIP fix yet (latest 4.19.325-cip136-rt50) |