CVE-2026-80694 Overview
CVE-2026-80694 is a Linux kernel vulnerability in the MediaTek Ethernet SoC driver (mtk_eth_soc). The mtk_poll_controller function passes the wrong pointer type to mtk_handle_irq_rx, which expects a struct mtk_eth * matching the request_irq cookie but instead receives a struct net_device *. When the kernel is built with CONFIG_NET_POLL_CONTROLLER enabled, invoking ndo_poll_controller triggers a crash in the receive interrupt handler. The upstream Linux kernel maintainers have merged fixes across multiple stable branches.
Critical Impact
Systems running affected Linux kernels on MediaTek Ethernet hardware with CONFIG_NET_POLL_CONTROLLER enabled can crash when netpoll paths (such as netconsole or kernel debugging over Ethernet) invoke the receive IRQ handler.
Affected Products
- Linux kernel builds including the mtk_eth_soc driver with CONFIG_NET_POLL_CONTROLLER enabled
- Systems using MediaTek Ethernet SoC network interfaces
- Downstream distributions shipping the affected kernel versions prior to the referenced stable commits
Discovery Timeline
- 2026-08-28 - CVE-2026-80694 published to NVD
- 2026-08-29 - Last updated in NVD database
Technical Details for CVE-2026-80694
Vulnerability Analysis
The defect is a type-confusion condition inside the MediaTek Ethernet SoC driver's netpoll path. The mtk_handle_irq_rx interrupt service routine is registered with request_irq using a struct mtk_eth * as its cookie. The function dereferences that pointer as an mtk_eth structure to access receive ring state and hardware registers.
The mtk_poll_controller implementation, invoked through the ndo_poll_controller net device operation, incorrectly forwards a struct net_device * argument to mtk_handle_irq_rx. The handler then interprets net_device fields as mtk_eth fields, producing invalid memory accesses and a kernel crash.
The crash surfaces whenever netpoll consumers such as netconsole, kgdboe, or kernel debuggers drive the poll controller path on an affected MediaTek interface.
Root Cause
The root cause is an incorrect pointer argument passed at the driver-internal call site. The interrupt handler's cookie contract (struct mtk_eth *) was not maintained by the poll controller wrapper, which passed the higher-level net_device pointer instead of the driver's private context. This is a driver-logic bug rather than a memory safety issue in generic kernel infrastructure.
Attack Vector
Exploitation requires the affected code path to execute. In practice, ndo_poll_controller is invoked by kernel subsystems that use netpoll, meaning the crash is triggered by local kernel activity rather than direct remote input. Any workload that activates netpoll on the MediaTek interface, including netconsole logging or in-kernel debugging over the network, will reach the faulty call site and destabilize the kernel.
The vulnerability is described in the upstream Linux stable tree. See Kernel Git Commit 276f1f18, Kernel Git Commit 3bd58ac9, Kernel Git Commit 7eb46318, and Kernel Git Commit e095f249 for the corrected argument passing.
Detection Methods for CVE-2026-80694
Indicators of Compromise
- Kernel oops or panic traces referencing mtk_handle_irq_rx or mtk_poll_controller in the call stack.
- Unexpected network interface resets or system reboots on hardware using the mtk_eth_soc driver.
- Crash reports coinciding with netconsole, kgdboe, or other netpoll consumer activity.
Detection Strategies
- Inventory Linux systems running MediaTek Ethernet hardware and audit their kernel CONFIG_NET_POLL_CONTROLLER build option.
- Compare running kernel versions against the fixed commits listed in the upstream stable tree references.
- Review kernel crash dumps and dmesg output for stack frames involving mtk_eth_soc symbols.
Monitoring Recommendations
- Forward kernel logs and crash telemetry to a centralized logging or SIEM platform for correlation.
- Alert on repeated kernel panics from network driver call sites on MediaTek-based devices.
- Track patch state for the mtk_eth_soc driver across managed Linux fleets as part of vulnerability management.
How to Mitigate CVE-2026-80694
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced by the stable tree commits to all affected systems.
- Prioritize embedded devices, routers, and appliances using MediaTek Ethernet SoCs where kernel rebuilds are required.
- Coordinate with hardware and distribution vendors to obtain updated firmware or kernel packages.
Patch Information
The fix has been merged into multiple stable Linux kernel branches. Reference commits: Kernel Git Commit 276f1f18, Kernel Git Commit 3bd58ac9, Kernel Git Commit 7eb46318, and Kernel Git Commit e095f249. Rebuild or update kernels to include the corrected argument passed to mtk_handle_irq_rx.
Workarounds
- Disable CONFIG_NET_POLL_CONTROLLER in custom kernel builds where netpoll functionality is not required.
- Avoid enabling netconsole, kgdboe, or other netpoll-dependent debugging features on MediaTek Ethernet interfaces until patches are applied.
- Restrict administrative access to reduce the likelihood of triggering netpoll code paths on unpatched hosts.
# Verify whether the running kernel enables the vulnerable code path
grep CONFIG_NET_POLL_CONTROLLER /boot/config-$(uname -r)
# Identify the active Ethernet driver on an interface
ethtool -i eth0 | grep driver
# Review recent kernel messages for mtk_eth_soc crash traces
dmesg | grep -iE 'mtk_eth|mtk_handle_irq_rx|mtk_poll_controller'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.