CVE-2026-98796: Linux Kernel mtk_eth_soc DOS Vulnerability

CVE-2026-98796 Overview

CVE-2026-98796 is a Linux kernel vulnerability in the MediaTek Ethernet SoC driver (mtk_eth_soc). The driver registers MAC network devices before allocating the internal dummy netdev (eth->dummy_dev) that carries the shared RX rings and NAPI context. This ordering creates a race window in which userspace can open the first interface before the shared NAPI state exists. On NETSYS v2 and later SoCs, mtk_rx_alloc() calls __xdp_rxq_info_reg() which dereferences a NULL eth->dummy_dev. On NETSYS v1 SoCs (MT7621, MT7622, MT7623, MT7629), the open path calls napi_enable() on an uninitialized napi_struct and dereferences a NULL napi->dev.

Critical Impact

A local race condition during driver probe causes a NULL pointer dereference and kernel-level denial of service on MediaTek-based networking hardware when an interface is opened within the probe window.

Affected Products

• Linux kernel mtk_eth_soc driver on NETSYS v2 and later MediaTek SoCs
• Linux kernel mtk_eth_soc driver on NETSYS v1 SoCs: MT7621, MT7622, MT7623, MT7629
• Linux distributions and OpenWrt builds shipping affected kernel versions on MediaTek hardware

Discovery Timeline

• 2026-10-18 - CVE-2026-98796 published to NVD
• 2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98796

Vulnerability Analysis

The mtk_eth_soc driver manages RX rings and a shared NAPI (New API) context on an internal dummy network device. During probe, mtk_probe() registers MAC netdevs through register_netdev() first, then allocates eth->dummy_dev and attaches the shared TX/RX NAPI to it. The network core exposes each MAC interface the moment register_netdev() returns, so any userspace agent that opens the interface in that window executes the first-open path without the shared state in place.

The race is a classic Time-of-Check Time-of-Use pattern between driver registration and shared-state initialization. OpenWrt's netifd is a realistic trigger because it brings up the WAN link as soon as the interface appears.

Root Cause

The root cause is incorrect initialization ordering in mtk_probe(). The driver publishes network interfaces to the kernel before the dependent shared data structures exist. The ordering has been present since initial MT7623 support. The fix allocates the dummy netdev and attaches the shared NAPI before the register_netdev() loop, and routes both allocation and registration failures through mtk_unreg_dev() to tear down any netdevs opened during the window. The probe error path also cancels eth->pending_work before freeing shared state, matching the behavior in mtk_cleanup().

Attack Vector

Exploitation requires local triggering of the probe path, typically through module load, device hotplug, or system boot with an interface management daemon that opens links immediately. The vulnerability is a NULL pointer dereference leading to a kernel warning or oops; mtk_open() returns -ENODEV on NETSYS v2, while NETSYS v1 crashes inside napi_enable(). No authenticated network interaction is required and no code execution primitive is described in the advisory.

See the upstream fixes for implementation details: Linux Kernel Commit 17eafd7, Linux Kernel Commit 4200183, Linux Kernel Commit 6f0c2c4, Linux Kernel Commit 82be3d0, and Linux Kernel Commit efc91ab.

Detection Methods for CVE-2026-98796

Indicators of Compromise

• Kernel log entries matching WARNING: ... Missing net_device from driver from net/core/xdp.c during interface bring-up on MediaTek hardware.
• mtk_open() returning -ENODEV immediately after driver probe on NETSYS v2 and later SoCs.
• Kernel oops or panic traces referencing napi_enable and mtk_eth_soc on MT7621, MT7622, MT7623, or MT7629 devices.

Detection Strategies

• Inventory devices running the mtk_eth_soc driver and correlate kernel versions against the fix commits linked above.
• Monitor dmesg and syslog for XDP RX queue registration warnings tied to the Ethernet driver during boot or hotplug events.
• Audit init scripts and interface managers such as netifd for behavior that opens interfaces at the moment of registration.

Monitoring Recommendations

• Centralize kernel ring buffer collection from embedded and gateway devices to catch probe-time warnings early.
• Alert on repeated interface bring-up failures with -ENODEV on affected hardware classes.
• Track kernel package versions across fleets to confirm patched builds reach all MediaTek-based nodes.

How to Mitigate CVE-2026-98796

Immediate Actions Required

• Apply the upstream kernel patches referenced in the Linux stable tree commits for the mtk_eth_soc driver.
• Update to a vendor kernel or OpenWrt build that incorporates the fix on all MediaTek NETSYS v1 and v2+ devices.
• Reboot affected systems after patching to ensure the corrected probe ordering is in effect.

Patch Information

The fix reorders mtk_probe() to allocate eth->dummy_dev and attach the shared TX/RX NAPI before the register_netdev() loop, and consolidates error handling through mtk_unreg_dev() with cancellation of eth->pending_work. Backports are available in multiple stable branches via the commits listed in the Technical Details section.

Workarounds

• Delay interface management daemons such as netifd from bringing up MediaTek Ethernet links until driver initialization is confirmed complete.
• Avoid dynamic module unload and reload of mtk_eth_soc on production hardware until the patched kernel is deployed.
• Where feasible, boot with network interfaces administratively down and bring them up after a short delay to reduce the race window.

# Verify running kernel and mtk_eth_soc module on an affected device
uname -r
modinfo mtk_eth_soc | grep -E 'filename|version|srcversion'
dmesg | grep -iE 'mtk_eth|xdp|napi'