CVE-2026-80694 (GCVE-0-2026-80694)

Vulnerability from cvelistv5 – Published: 2026-08-28 06:53 – Updated: 2026-08-29 06:22
VLAI
Title
net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller
Summary
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller mtk_handle_irq_rx expects a struct mtk_eth * (matching the request_irq cookie), but mtk_poll_controller incorrectly passed the net_device *. Calling ndo_poll_controller with CONFIG_NET_POLL_CONTROLLER enabled would then crash.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 8186f6e382d8719d0a4bc0ef218c4dd7cf55b496 , < 3bd58ac9ca0c552651f533c1bd280dd19ae7d4e8 (git)
Affected: 8186f6e382d8719d0a4bc0ef218c4dd7cf55b496 , < 276f1f180f55d56cf5992a581e20ed2b3dfa6ced (git)
Affected: 8186f6e382d8719d0a4bc0ef218c4dd7cf55b496 , < 7eb46318d53940dab63dea7130e720b67a656104 (git)
Affected: 8186f6e382d8719d0a4bc0ef218c4dd7cf55b496 , < e095f249e2209674f6366f6db0383a2b96e19239 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.8
Unaffected: 0 , < 4.8 (semver)
Unaffected: 6.12.103 , ≤ 6.12.* (semver)
Unaffected: 6.18.44 , ≤ 6.18.* (semver)
Unaffected: 7.1.8 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mediatek/mtk_eth_soc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3bd58ac9ca0c552651f533c1bd280dd19ae7d4e8",
              "status": "affected",
              "version": "8186f6e382d8719d0a4bc0ef218c4dd7cf55b496",
              "versionType": "git"
            },
            {
              "lessThan": "276f1f180f55d56cf5992a581e20ed2b3dfa6ced",
              "status": "affected",
              "version": "8186f6e382d8719d0a4bc0ef218c4dd7cf55b496",
              "versionType": "git"
            },
            {
              "lessThan": "7eb46318d53940dab63dea7130e720b67a656104",
              "status": "affected",
              "version": "8186f6e382d8719d0a4bc0ef218c4dd7cf55b496",
              "versionType": "git"
            },
            {
              "lessThan": "e095f249e2209674f6366f6db0383a2b96e19239",
              "status": "affected",
              "version": "8186f6e382d8719d0a4bc0ef218c4dd7cf55b496",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mediatek/mtk_eth_soc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.8"
            },
            {
              "lessThan": "4.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller\n\nmtk_handle_irq_rx expects a struct mtk_eth * (matching the request_irq\ncookie), but mtk_poll_controller incorrectly passed the net_device *.\nCalling ndo_poll_controller with CONFIG_NET_POLL_CONTROLLER enabled\nwould then crash."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is only reachable via ndo_poll_controller called from netpoll during netconsole transmit polling on the mtk netdev; on MediaTek routers/gateways with netconsole on the primary ethernet interface, remote network traffic that triggers kernel logging and netpoll send retries can invoke the corrupt path without local access.\nAC:L - Once netconsole is bound to the mtk interface, netpoll_poll_dev calls mtk_poll_controller deterministically during log transmission and skb allocation retries, without races or attacker-dependent timing beyond routine network activity.\nPR:N - Exploitation requires no attacker credentials or capabilities; only an administrator-preconfigured netconsole target on the mtk netdev (an environmental prerequisite), after which any unprivileged remote party can trigger the path by causing kernel log emission.\nUI:N - No victim user action is required beyond normal system operation; triggering relies on automated kernel logging and netpoll activity, not on a user opening files, mounting filesystems, or interacting with the UI.\nS:U - Impact is confined to kernel memory corruption and crash within the same kernel security authority; this is not a VM escape, sandbox breakout, or cross-authority boundary violation.\nC:H - Casting net_device to mtk_eth causes reads of attacker-influenced adjacent memory through napi_schedule_prep and potential MMIO via a misinterpreted soc/base pointer, constituting exploitable type confusion rather than a bounded NULL dereference.\nI:H - The mistyped pointer causes an unconditional increment at the mtk_eth rx_events offset (writing into net_device/adjacent heap memory) and may corrupt or schedule a bogus NAPI structure, giving memory corruption primitives.\nA:H - The fix commit and handler logic confirm the mistyped pointer leads to invalid structure access and likely kernel oops/panic when netpoll_controller is invoked, causing complete loss of availability on affected devices."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-29T06:22:18.328Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3bd58ac9ca0c552651f533c1bd280dd19ae7d4e8"
        },
        {
          "url": "https://git.kernel.org/stable/c/276f1f180f55d56cf5992a581e20ed2b3dfa6ced"
        },
        {
          "url": "https://git.kernel.org/stable/c/7eb46318d53940dab63dea7130e720b67a656104"
        },
        {
          "url": "https://git.kernel.org/stable/c/e095f249e2209674f6366f6db0383a2b96e19239"
        }
      ],
      "title": "net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80694",
    "datePublished": "2026-08-28T06:53:00.442Z",
    "dateReserved": "2026-08-26T14:34:25.785Z",
    "dateUpdated": "2026-08-29T06:22:18.328Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80694",
      "date": "2026-09-23",
      "epss": "0.00463",
      "percentile": "0.39388"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-23T02:15:09.000Z",
      "cve": "CVE-2026-80694",
      "id": "msrc_CVE-2026-80694",
      "initial_release_date": "2026-08-29T01:03:28.000Z",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-80694.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/mediatek/mtk_eth_soc.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "3bd58ac9ca0c552651f533c1bd280dd19ae7d4e8",
                    "status": "affected",
                    "version": "8186f6e382d8719d0a4bc0ef218c4dd7cf55b496",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "276f1f180f55d56cf5992a581e20ed2b3dfa6ced",
                    "status": "affected",
                    "version": "8186f6e382d8719d0a4bc0ef218c4dd7cf55b496",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7eb46318d53940dab63dea7130e720b67a656104",
                    "status": "affected",
                    "version": "8186f6e382d8719d0a4bc0ef218c4dd7cf55b496",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e095f249e2209674f6366f6db0383a2b96e19239",
                    "status": "affected",
                    "version": "8186f6e382d8719d0a4bc0ef218c4dd7cf55b496",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/mediatek/mtk_eth_soc.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.8"
                  },
                  {
                    "lessThan": "4.8",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.103",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.44",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller\n\nmtk_handle_irq_rx expects a struct mtk_eth * (matching the request_irq\ncookie), but mtk_poll_controller incorrectly passed the net_device *.\nCalling ndo_poll_controller with CONFIG_NET_POLL_CONTROLLER enabled\nwould then crash."
          }
        ],
        "id": "CVE-2026-80694",
        "lastModified": "2026-08-29T07:16:51.580",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-28T08:16:54.883",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/276f1f180f55d56cf5992a581e20ed2b3dfa6ced"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3bd58ac9ca0c552651f533c1bd280dd19ae7d4e8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7eb46318d53940dab63dea7130e720b67a656104"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e095f249e2209674f6366f6db0383a2b96e19239"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-31T08:04:59+00:00",
      "cve": "CVE-2026-80694",
      "id": "CVE-2026-80694",
      "initial_release_date": "2026-08-28T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80694.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:09:44Z",
      "cve": "CVE-2026-80694",
      "id": "CVE-2026-80694",
      "initial_release_date": "2026-08-28T16:33:57Z",
      "product_status:known_affected": "347",
      "product_status:known_not_affected": "6",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80694",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80694.json",
      "version": "8"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.