Executive brief
The Linux kernel's Mediatek ethernet driver contains a type mismatch bug in the poll controller function. When network polling is enabled, the function passes an incorrect pointer type to an interrupt handler, causing a kernel crash. This affects systems using Mediatek ethernet adapters with polling enabled.
Technical details
A type confusion vulnerability exists in the mtk_poll_controller() function within drivers/net/ethernet/mediatek/mtk_eth_soc.c. The mtk_handle_irq_rx() function expects a struct mtk_eth pointer (matching the request_irq cookie), but mtk_poll_controller() incorrectly passes a struct net_device pointer instead. When CONFIG_NET_POLL_CONTROLLER is enabled and ndo_poll_controller is called, this causes a kernel crash due to dereferencing the wrong pointer type. The fix involves changing one parameter from 'dev' to 'eth' in the function call. Patches are available in the stable kernel trees.
Affected products
- Linux Linux Kernel Multiple versions across 2.6.11 through 6.9 and later; specific vulnerable versions not enumerated in advisory
Timeline
- 2026-08-28: disclosed: CVE published on NVD
- 2026-07-23: patched: Upstream fix commit e095f249e2209674f6366f6db0383a2b96e19239 authored
- 2026-08-09: other: Fix backported to stable kernel branches