CVE-2026-99196

In the Linux kernel, the following vulnerability has been resolved:

net: au1000: move setting of netops to fix crash

au1000 probe() calls au1000 mii probe(), which connects the PHY, before dev->netdev ops is assigned. phy attach direct() -> phy link topo add phy() reads dev->netdev ops through netdev need ops lock() since the commit in question, so probing crashes with a NULL pointer dereference when CONFIG NET SHAPER is enabled.

Assign netdev ops before the PHY attach, as was done for emac in commit 7c9f391ec89c ("net: emac: move setting of netops to fix crash").