Is CVE-2026-99197 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-99197 being exploited in the wild.

How severe is CVE-2026-99197?

Informational severity, published 28 October 2026.

Which products and versions are affected?

Linux Kernel affected versions include those with CONFIG_NET_SHAPER enabled and commit ded86da4bbb7 or later.

Is there a fix for CVE-2026-99197?

A patch was published on 2026-10-15: upstream commit a3eef3d2cca032d8768b5eb07aab0f46b79bfd8a Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-99197 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-99197?

Check whether you run Linux Kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-99197: Linux kernel mv643xx_eth NULL pointer dereference in PHY probe

CVE-2026-99197 · Severity: info · Published 2026-10-28

The Linux kernel's mv643xx Ethernet driver crashes with a NULL pointer error during network device initialization when CONFIG_NET_SHAPER is enabled. An attacker with the ability to trigger device probe operations could cause a denial of service, though this typically requires local access or control over device hotplug events.

Technologies: Linux Kernel. Vendors: Linux.

Quick answers

Is CVE-2026-99197 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-99197 being exploited in the wild.
How severe is CVE-2026-99197?: Informational severity, published 28 October 2026.
Which products and versions are affected?: Linux Kernel affected versions include those with CONFIG_NET_SHAPER enabled and commit ded86da4bbb7 or later.
Is there a fix for CVE-2026-99197?: A patch was published on 2026-10-15: upstream commit a3eef3d2cca032d8768b5eb07aab0f46b79bfd8a Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-99197 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-99197?: Check whether you run Linux Kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The mv643xx_eth_probe() function attempts to attach a PHY before initializing the device's netdev_ops structure. Since commit ded86da4bbb7, phy_attach_direct() now reads dev->netdev_ops through netdev_need_ops_lock() when CONFIG_NET_SHAPER is enabled, causing a NULL pointer dereference. The fix reorders initialization to assign netdev_ops before PHY attachment.

Affected products

Linux kernel affected versions include those with CONFIG_NET_SHAPER enabled and commit ded86da4bbb7 or later

Timeline

2026-10-28: disclosed
2026-10-15: patched: upstream commit a3eef3d2cca032d8768b5eb07aab0f46b79bfd8a

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.