CVE-2026-80694

The mtk_poll_controller() function in the Linux kernel's MediaTek Ethernet driver (mtk_eth_soc) incorrectly passes a struct net_device pointer to mtk_handle_irq_rx(), which expects the struct mtk_eth pointer used as the request_irq cookie. The bug is triggered when the kernel's network polling path (ndo_poll_controller, i.e., netpoll as used by netconsole or kgdb-over-ethernet) is invoked on a kernel built with CONFIG_NET_POLL_CONTROLLER enabled, and results in a kernel crash. An attacker gains denial of service of the affected machine; exploitation requires the rare netpoll configuration to be in use. Affected systems are Linux kernels shipping the mtk_eth_soc driver with network-polling support enabled, typically MediaTek-based routers, gateways, and embedded boards. No public proof of concept is known, it is not in CISA KEV, and EPSS puts 30-day exploitation probability at roughly 0.5%.

What to do: Update affected systems to a kernel that includes the upstream fix 'net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller'. As a mitigation, avoid using netpoll-based features such as netconsole on MediaTek-ethernet systems, or rebuild without CONFIG_NET_POLL_CONTROLLER. Check whether your devices run a MediaTek (mtk_eth_soc) Ethernet interface and whether netconsole is configured.