CVE-2026-80614

CVE-2026-80614 is a NULL pointer dereference in the Linux kernel's "net: emac" Ethernet driver, occurring in the driver's probe routine. The bug existed because devm_request_irq() was called before devm_platform_ioremap_resource(), so an interrupt arriving early could invoke the emac_irq() handler before the dev->emacp resource pointer was mapped, dereferencing NULL and crashing the kernel. An attacker gains a denial of service (availability impact only, per the CVSS scoring: no confidentiality or integrity impact) during device initialization. Affected are systems running Linux kernels that include the emac driver for the corresponding Ethernet hardware, where the probe-time race could be hit. The flaw is not known to be exploited, has no public proof-of-concept, and carries a low exploitation probability (EPSS 0.4%, 36th percentile).

What to do: Update to a Linux kernel that includes the upstream fix reordering devm_request_irq() after devm_platform_ioremap_resource() in emac_probe(), then reboot into the patched kernel. Check whether the emac driver is enabled in your kernel configuration and used by your hardware; if you are affected but cannot patch immediately, treat this as a boot/probe-time crash risk rather than an attacker-facing flaw, since no in-the-wild exploitation or public PoC is known.