Riskcovery

CVE-2026-31736

net: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled

State
Published
Severity
Not scored
Published
May 1, 2026
Updated
May 11, 2026
Reserved
Mar 9, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

net: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled

If the gmac0 is disabled, the precheck for a valid ingress device will cause a NULL pointer deref and crash the system. This happens because eth->netdev[0] will be NULL but the code will directly try to access netdev_ops.

Instead of just checking for the first net_device, it must be checked if any of the mtk_eth net_devices is matching the netdev_ops of the ingress device.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 73cfd947dbdb25ef9863ac49c4596a7d53ad4025 to before 0b832aad33e6f160fda310f0306a6483d85e9d6eAffected
  • 73cfd947dbdb25ef9863ac49c4596a7d53ad4025 to before 5dff799c677152dde963c3917bacd9127b03e145Affected
  • 73cfd947dbdb25ef9863ac49c4596a7d53ad4025 to before 7b2380f0a0e374010c1a4a13203511b9dee5b166Affected
  • 73cfd947dbdb25ef9863ac49c4596a7d53ad4025 to before 976ff48c2ac6e6b25b01428c9d7997bcd0fb2949Affected
LinuxLinux
  • 6.11Affected
  • before 6.11Not affected
  • 6.12.81 through 6.12.*Not affected
  • 6.18.22 through 6.18.*Not affected
  • 6.19.12 through 6.19.*Not affected
  • 7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.