CVE-2026-80614: Linux Kernel Use-After-Free Vulnerability

CVE-2026-80614 Overview

CVE-2026-80614 is a NULL pointer dereference vulnerability in the Linux kernel's EMAC Ethernet driver. The flaw resides in the emac_probe() function, where devm_request_irq() was called before devm_platform_ioremap_resource() completed the memory-mapped I/O setup. An interrupt that fires before dev->emacp is mapped causes the interrupt handler emac_irq() to dereference a NULL pointer, crashing the kernel. The fix reorders the probe sequence so the I/O resource is mapped before interrupts can be delivered. The commit also removes a redundant error message already emitted by devm_platform_ioremap_resource() via dev_err_probe().

Critical Impact
A race between device probe and early interrupt delivery can trigger a kernel NULL pointer dereference, producing a denial of service on affected systems using the EMAC driver.

Affected Products

Linux kernel versions containing the pre-patch emac_probe() ordering in the net/ethernet/apm/xgene EMAC driver
Distributions shipping vulnerable stable kernel branches prior to the referenced patch commits
Embedded and server platforms that instantiate the EMAC network device at boot

Discovery Timeline

2026-08-28 - CVE-2026-80614 published to NVD
2026-08-29 - Last updated in NVD database

Technical Details for CVE-2026-80614

Vulnerability Analysis

The vulnerability is a classic initialization ordering defect in a Linux platform driver's probe path. In the vulnerable code, emac_probe() registers the interrupt handler using devm_request_irq() prior to mapping the device's MMIO region with devm_platform_ioremap_resource(). Once IRQ registration succeeds, the kernel may deliver a pending or spurious interrupt to emac_irq() while dev->emacp still holds its initial NULL value. The handler then dereferences this NULL register base to acknowledge or process the interrupt, producing an oops. This class of defect is categorized as a NULL Pointer Dereference and leads to availability loss.

Root Cause

The root cause is the incorrect ordering of resource acquisition versus interrupt registration during device probing. Interrupt handlers must never observe partially initialized driver state, yet the previous ordering exposed a window in which dev->emacp was still NULL when emac_irq() could run. Compounding the issue, the driver emitted a redundant probe error message despite devm_platform_ioremap_resource() already reporting failures through dev_err_probe().

Attack Vector

Exploitation does not require a crafted payload; the crash is triggered by the timing of hardware or platform-generated interrupts during driver initialization. On systems where the EMAC IP block asserts an interrupt line before or during probe (for example, due to prior firmware activity, shared IRQ lines, or level-triggered pending interrupts), the race window is naturally exercised at boot. The result is a kernel oops or panic and interruption of network initialization. The vulnerability is a local reliability defect; the CVSS network attack vector reflects the exposure of the network stack component rather than a remote exploitation path.

No verified proof-of-concept code has been published. The upstream fix reorders devm_platform_ioremap_resource() before devm_request_irq() and removes the redundant dev_err call. See the Linux Kernel Commit 44068b6863, Linux Kernel Commit a103cdb068, and Linux Kernel Commit f623d38fe6 for the patch content.

Detection Methods for CVE-2026-80614

Indicators of Compromise

Kernel oops or panic traces referencing emac_irq and a NULL pointer dereference in the fault address
Boot-time crashes on systems that instantiate an EMAC network device, with the failure occurring inside emac_probe
Missing or non-functional EMAC network interfaces after boot on affected kernels

Detection Strategies

Inventory running kernel versions across Linux hosts and compare against the fixed commit IDs 44068b6863, a103cdb068, and f623d38fe6
Review dmesg and persistent kernel logs for stack traces containing emac_probe or emac_irq alongside NULL dereference messages
Correlate repeated unexpected reboots on EMAC-equipped platforms with driver initialization failures

Monitoring Recommendations

Forward /var/log/kern.log, journalctl -k, and kdump crash artifacts to a central logging platform for retention and search
Alert on kernel oops signatures naming EMAC driver symbols and on repeated boot failures for the same host
Track patch state via configuration management so that kernels lacking the fix are flagged during compliance scans

How to Mitigate CVE-2026-80614

Immediate Actions Required

Apply the vendor-provided kernel update that includes commits 44068b6863, a103cdb068, or f623d38fe6 to all affected hosts
Prioritize patching of embedded and server platforms that use the EMAC Ethernet controller and are exposed to unexpected reboots
Validate post-patch that the EMAC interface initializes cleanly and no emac_irq NULL dereference traces appear in kernel logs

Patch Information

The upstream fix moves devm_request_irq() after devm_platform_ioremap_resource() so that dev->emacp is valid before the interrupt handler can execute. It also removes the redundant dev_err message. Rebuild or install kernels from your distribution containing one of the referenced stable commits: 44068b6863, a103cdb068, or f623d38fe6.

Workarounds

Where patching is not immediately possible, disable or blacklist the EMAC driver module on hosts that do not require the interface
Restrict boot-time firmware or bootloader activity that may leave EMAC interrupts pending prior to kernel handoff
Schedule accelerated maintenance windows for systems observing repeat crashes traced to emac_probe

bash

# Verify the running kernel includes the fix and inspect for prior crashes
uname -r
journalctl -k --no-pager | grep -iE 'emac_probe|emac_irq|NULL pointer'
# Optionally blacklist the EMAC module until a fixed kernel is deployed
echo 'blacklist emac' | sudo tee /etc/modprobe.d/blacklist-emac.conf