Look up another CVE · open CVE-2026-80694 in the interactive tracker
CVE-2026-80694
net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller
Published 2026-08-28 (2 months ago) by the Linux kernel CNA. Subsystem drivers/net. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-80694 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | vulnerable | 6.1.190-1 | No fix published anywhere yet, neither in Debian nor upstream for the series bookworm tracks. Watch the Debian tracker page for this CVE. Advisories for bookworm have historically landed a median of 23 days after publication. |
| Debian 13trixie | fixed | 6.12.105-1 | Update the kernel and reboot. Fixed in 6.12.105-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.8-1 | Update the kernel and reboot. Fixed in 7.1.8-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.8-1 | Update the kernel and reboot. Fixed in 7.1.8-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4788-1 · 2026-09-19 · text | 6.12.107-1~deb12u1 | Update the kernel and reboot. DLA-4788-1 shipped the fix on 2026-09-19, in 6.12.107-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
mtk_handle_irq_rx expects a struct mtk_eth * (matching the request_irq cookie), but mtk_poll_controller incorrectly passed the net_device *. Calling ndo_poll_controller with CONFIG_NET_POLL_CONTROLLER enabled would then crash.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/net/ethernet/mediatek/mtk_eth_soc.c
- What this is
- MEDIATEK ETHERNET DRIVERMAINTAINERS section matched on drivers/net/ethernet/mediatek/ · netdev@vger.kernel.org · Maintained
- Kernel module
- mtk_eth
Check it on the machine
grep -wE 'CONFIG_ETHERNET|CONFIG_NET_MEDIATEK_SOC|CONFIG_NET_VENDOR_MEDIATEK' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w mtk_ethPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian does not build this code in 1 release. It does build it in 4 releases, so the answer depends on which release the machine runs.
- bookwormn
- trixieMnot built on amd64/amd64, amd64/cloud-amd64, amd64/rt/amd64, arm64/cloud-arm64, armel/rpi, armhf/armmp, armhf/armmp-lpae, armhf/rt/armmp, ppc64el/powerpc64le, ppc64el/powerpc64le-64k, riscv64/riscv64, s390x/s390x
- forky, sidMnot built on amd64/amd64, amd64/cloud-amd64, amd64/rt-amd64, arm64/cloud-arm64, armhf/armmp, armhf/armmp-lpae, loong64/loong64, ppc64el/powerpc64le, ppc64el/powerpc64le-64k, riscv64/riscv64, s390x/s390x
- bookworm · linux-6.12Mnot built on amd64/amd64, amd64/cloud-amd64, amd64/rt/amd64, arm64/cloud-arm64, armhf/armmp, armhf/armmp-lpae, armhf/rt/armmp, ppc64el/powerpc64le, ppc64el/powerpc64le-64k
- n
- not enabled on any flavour - this release does not build the code
- M
- a module where it is built at all; some flavours do not build it
- Build switches
- CONFIG_ETHERNET, CONFIG_NET_MEDIATEK_SOC, CONFIG_NET_VENDOR_MEDIATEK
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-28 (2 months ago)source
- CVSS
- 9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.67%, higher than 51.1% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/net
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 4.8 | 6.12.103 | 3bd58ac9ca0c |
| 4.8 | 6.18.44 | 276f1f180f55 |
| 4.8 | 7.1.8 | 7eb46318d539 |
| 4.8 | 7.2 | e095f249e220 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4788-1 | 2026-09-19 | bookworm 6.12.107-1~deb12u1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- The bug is only reachable via ndo_poll_controller called from netpoll during netconsole transmit polling on the mtk netdev; on MediaTek routers/gateways with netconsole on the primary ethernet interface, remote network traffic that triggers kernel logging and netpoll send retries can invoke the corrupt path without local access.
- AC:LAttack complexity, low
- Once netconsole is bound to the mtk interface, netpoll_poll_dev calls mtk_poll_controller deterministically during log transmission and skb allocation retries, without races or attacker-dependent timing beyond routine network activity.
- PR:NPrivileges required, none
- Exploitation requires no attacker credentials or capabilities; only an administrator-preconfigured netconsole target on the mtk netdev (an environmental prerequisite), after which any unprivileged remote party can trigger the path by causing kernel log emission.
- UI:NUser interaction, none
- No victim user action is required beyond normal system operation; triggering relies on automated kernel logging and netpoll activity, not on a user opening files, mounting filesystems, or interacting with the UI.
- S:UScope, unchanged
- Impact is confined to kernel memory corruption and crash within the same kernel security authority; this is not a VM escape, sandbox breakout, or cross-authority boundary violation.
- C:HConfidentiality impact, high
- Casting net_device to mtk_eth causes reads of attacker-influenced adjacent memory through napi_schedule_prep and potential MMIO via a misinterpreted soc/base pointer, constituting exploitable type confusion rather than a bounded NULL dereference.
- I:HIntegrity impact, high
- The mistyped pointer causes an unconditional increment at the mtk_eth rx_events offset (writing into net_device/adjacent heap memory) and may corrupt or schedule a bogus NAPI structure, giving memory corruption primitives.
- A:HAvailability impact, high
- The fix commit and handler logic confirm the mistyped pointer leads to invalid structure access and likely kernel oops/panic when netpoll_controller is invoked, causing complete loss of availability on affected devices.