CVE-2026-99195

A flaw was found in the Linux kernel's OpenCores Ethernet driver (ethoc). During device initialization, the driver connects the physical network interface before assigning its network device operations. A local attacker capable of triggering device probing on a system configured with network traffic shaping can induce a NULL pointer dereference. This flaw leads to a kernel crash, resulting in a Denial of Service (DoS).

This vulnerability is rated Moderate because triggering the defect requires local privileged access to initiate device discovery on systems where network shaping functionality is enabled. The exposure is confined to hardware configurations deploying the OpenCores Ethernet controller, which is not standard across default enterprise server environments. While a local administrator or privileged process could trigger a kernel panic causing a denial of service, the issue cannot be exploited remotely and does not compromise system integrity or confidentiality.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.