CVE-2026-98796

In the Linux kernel, the following vulnerability has been resolved:

net: ethernet: mtk eth soc: allocate dummy netdev sooner

The RX rings and the shared NAPI are carried by an internal "dummy" netdev (eth->dummy dev). mtk probe() creates that dummy device, and adds the shared tx/rx NAPI to it, only after the MAC netdevs have been registered. That order has been there since the MT7623 support was added and leaves a window in which the netdevs are visible to the network core before the shared NAPI and the dummy device exist.

If anything brings the first netdev up during that window (e.g. netifd opening the WAN link the instant the interface is registered), the first-open path runs without them. On NETSYS v2 and later SoCs mtk rx alloc() -> xdp rxq info reg() then dereferences eth->dummy dev == NULL:

WARNING: CPU: ... Missing net device from driver

in net/core/xdp.c and mtk open() fails with -ENODEV. On NETSYS v1 SoCs (MT7621/MT7622/MT7623/MT7629) there is no page pool, so the same open instead calls napi enable() on a napi struct that netif napi add() has not initialised yet and dereferences a NULL napi->dev.

Allocate the dummy netdev and add the shared tx/rx NAPI to it before the register netdev() loop. Both the dummy-allocation failure and a register netdev() failure now unwind through mtk unreg dev(), which unregisters the net device notifiers and the netdevs registered so far, stopping a concurrently-opened netdev (ndo stop) and its NAPI before the dummy carrier is freed.

A netdev that opened during the window can also have queued the frame-engine reset worker (via the tx watchdog or phylink), so the probe error path now cancels eth->pending work before freeing the shared state, as mtk cleanup() already does on remove.