{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  net: au1000: move setting of netops to fix crash  au1000_probe() calls au1000_mii_probe(), which connects the PHY, before dev-\u003enetdev_ops is assigned. phy_attach_direct() -\u003e phy_link_topo_add_phy() reads dev-\u003enetdev_ops through netdev_need_ops_lock() since the commit in question, so probing crashes with a NULL pointer dereference when CONFIG_NET_SHAPER is enabled.  Assign netdev_ops before the PHY attach, as was done for emac in commit 7c9f391ec89c (\"net: emac: move setting of netops to fix crash\").",
  "id": "DEBIAN-CVE-2026-99196",
  "modified": "2026-10-29T05:47:33.604957759Z",
  "published": "2026-10-28T11:17:40.667Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-99196"
    }
  ],
  "upstream": [
    "CVE-2026-99196"
  ]
}