Description

In the Linux kernel, the following vulnerability has been resolved: net: emac: Fix NULL pointer dereference in emac_probe Move devm_request_irq() after devm_platform_ioremap_resource() so that dev->emacp is mapped before the interrupt handler can fire. An early interrupt hitting emac_irq() would dereference the NULL dev->emacp and crash. Also remove redundant error message. devm_platform_ioremap_resource() already returns an error message with dev_err_probe().

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-28T08:16:45.430Z",
  "pubdate": "2026-08-28T08:16:45.430Z",
  "executiveSummary": "A race condition vulnerability exists in the Linux kernel EMAC driver during the initialization sequence within the emac_probe function.\nThe vulnerability is classified as a NULL pointer dereference, which can lead to a system-wide kernel panic and subsequent Denial of Service (DoS).\nThe flaw stems from an improper ordering of resource allocation functions, specifically allowing the interrupt handler to register and execute before the necessary memory-mapped I/O (MMIO) resources are assigned to the device structure.\nThis impacts the stability of the Linux kernel on affected hardware utilizing the EMAC driver.\nAn attacker capable of triggering hardware interrupts during the driver probe phase can induce a crash. The vulnerability requires no specific authentication or remote network access, as the execution occurs during the local system boot or module loading phase.\nThe risk is primarily identified as system availability compromise due to the severity of a kernel-level memory violation.",
  "technicalDetails": "The root cause of this vulnerability is a race condition within the emac_probe function in the Linux kernel's EMAC driver. During the driver initialization routine, the interrupt request function, devm_request_irq(), was historically invoked prior to the completion of memory-mapped I/O resource allocation via devm_platform_ioremap_resource().\nIn the Linux kernel architecture, the interrupt handler emac_irq() relies on the internal state of the device structure, specifically the dev->emacp pointer, which is initialized by the devm_platform_ioremap_resource() function. Because the interrupt handler is registered early in the probe sequence, an external hardware interrupt signal can be asserted before the initialization of dev->emacp is complete.\nWhen an interrupt occurs during this race window, the kernel executes emac_irq() while dev->emacp remains NULL. Inside the interrupt handler, the code attempts to dereference this NULL pointer to access register offsets or device configuration data. This invalid memory access triggers a kernel oops or a panic, immediately halting system execution.\nThe attack flow requires the system to be in the process of probing the EMAC device. If an interrupt is triggered by the hardware during the brief interval between the IRQ registration and the completion of the MMIO mapping, the kernel context jumps to the handler. The handler, expecting a valid mapped address space, accesses the NULL pointer, resulting in a segmentation fault within kernel space.\nThis vulnerability is restricted to the local execution environment, as it relies on the physical timing of the hardware driver probe. No authentication is required, as the kernel assumes trust in the hardware-driver interaction during initialization. Post-exploitation, the impact is a hard crash of the affected system, effectively preventing the driver from loading and potentially rendering the associated network interface non-functional, which constitutes a critical availability failure.\nFurthermore, the original implementation included redundant error reporting, where manual print statements were used alongside devm_platform_ioremap_resource(), which already handles error logging via dev_err_probe(). Removing this redundancy and reordering the initialization sequence ensures that the memory-mapped environment is fully established and validated before the kernel subsystem is enabled to process hardware-driven interrupts."
}