Description

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller mtk_handle_irq_rx expects a struct mtk_eth * (matching the request_irq cookie), but mtk_poll_controller incorrectly passed the net_device *. Calling ndo_poll_controller with CONFIG_NET_POLL_CONTROLLER enabled would then crash.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-28T08:16:54.883Z",
  "pubdate": "2026-08-28T08:16:54.883Z",
  "executiveSummary": "The vulnerability is identified as a pointer type mismatch in the mtk_eth_soc driver, specifically within the poll_controller functionality.\nA failure to pass the correct structure reference when invoking mtk_handle_irq_rx leads to a kernel panic when CONFIG_NET_POLL_CONTROLLER is enabled.\nThe impact is a complete denial of service (DoS) caused by an system crash during network polling operations.\nAffected systems include Linux kernel environments utilizing the mtk_eth_soc driver.\nExploitation requires the kernel to be compiled with specific diagnostic or out-of-band networking features enabled, primarily affecting administrative operations where the netpoll mechanism is triggered.\nThe risk is categorized as moderate, as it requires specific environmental configurations to trigger the crash but results in immediate service disruption.",
  "technicalDetails": "The root cause of this vulnerability lies in an improper function argument type handling within the mtk_poll_controller function of the mtk_eth_soc driver.\nWhen the netpoll framework invokes the ndo_poll_controller callback, the mtk_poll_controller implementation erroneously passes a pointer to the net_device structure (struct net_device *) to the mtk_handle_irq_rx function.\nThe mtk_handle_irq_rx function is architecturally designed to receive a pointer to the mtk_eth controller structure (struct mtk_eth *), which matches the cookie provided during the original request_irq operation.\nBecause the function signature expects a specific memory layout associated with the mtk_eth structure, it attempts to access members of the passed net_device pointer as if they were part of the mtk_eth structure. This dereferencing of improperly cast pointers results in an invalid memory access or null pointer dereference, triggering a kernel oops or panic.\nThe attack flow follows this sequence: 1) The system administrator or kernel process enables network polling functionality (CONFIG_NET_POLL_CONTROLLER). 2) The network stack triggers the ndo_poll_controller callback for the MediaTek Ethernet interface. 3) The driver executes mtk_poll_controller and invokes mtk_handle_irq_rx with the incorrect pointer type. 4) The kernel attempts to dereference the miscast pointer to access hardware registers or internal state. 5) The memory management unit or kernel fault handler detects an illegal access, resulting in an immediate system crash.\nThis vulnerability is restricted to kernels where CONFIG_NET_POLL_CONTROLLER is defined and active for the specific hardware. It does not require authentication or remote access to trigger, as the code path is executed through standard internal kernel networking logic. The post-exploitation impact is primarily limited to system availability, resulting in a denial-of-service condition."
}