CVE-2026-80614

A flaw was found in the Linux kernel's emac network driver. An early interrupt in the emac_irq() handler can occur before the dev->emacp pointer is properly initialized. This can lead to a NULL pointer dereference, causing the system to crash and resulting in a Denial of Service (DoS).

A moderate-impact NULL pointer dereference flaw was found in the Linux kernel's emac network driver. During device probing, the interrupt handler emac_irq() could fire before devm_platform_ioremap_resource() had mapped the device registers, so the dev->emacp pointer was still NULL when dereferenced, causing a kernel crash and resulting in a denial of service. Red Hat assessed this flaw as Moderate (CVSS 5.5, AV:L/PR:L) because the crash can only be triggered during probing of an emac-based network device, which requires local access to the system; this differs from the upstream CVEORG CVSS score of 7.5 (AV:N), which assumes a network attack vector that this probe-time race condition does not provide. The vulnerable code is not present in the Red Hat Enterprise Linux 6, 7, 8, 9, and 10 kernel and kernel-rt packages, nor in the Red Hat In-Vehicle OS kernel packages, so no Red Hat products are affected by this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.