---
id: CVE-2026-80694
title: 'net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller

  mtk_handle_irq_rx expects a struct mtk_eth * (matching the request_irq
  cookie), but mtk_po…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 8186f6e382d8719d0a4bc0ef218c4dd7cf55b496 <
    a9133c4d335e48ba92f4daed10c506378924f976
  - >-
    Linux >= 8186f6e382d8719d0a4bc0ef218c4dd7cf55b496 <
    3bd58ac9ca0c552651f533c1bd280dd19ae7d4e8
  - >-
    Linux >= 8186f6e382d8719d0a4bc0ef218c4dd7cf55b496 <
    276f1f180f55d56cf5992a581e20ed2b3dfa6ced
  - >-
    Linux >= 8186f6e382d8719d0a4bc0ef218c4dd7cf55b496 <
    7eb46318d53940dab63dea7130e720b67a656104
  - >-
    Linux >= 8186f6e382d8719d0a4bc0ef218c4dd7cf55b496 <
    e095f249e2209674f6366f6db0383a2b96e19239
  - Linux 4.8
published: '2026-08-28'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T12:46:55.044Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-80694'
references:
  - url: 'https://git.kernel.org/stable/c/a9133c4d335e48ba92f4daed10c506378924f976'
  - url: 'https://git.kernel.org/stable/c/3bd58ac9ca0c552651f533c1bd280dd19ae7d4e8'
  - url: 'https://git.kernel.org/stable/c/276f1f180f55d56cf5992a581e20ed2b3dfa6ced'
  - url: 'https://git.kernel.org/stable/c/7eb46318d53940dab63dea7130e720b67a656104'
  - url: 'https://git.kernel.org/stable/c/e095f249e2209674f6366f6db0383a2b96e19239'
tags:
  - cve.org
epss: 0.00671
epssPercentile: 0.51176
ingestedAt: '2026-10-21T12:48:53.750Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller

mtk_handle_irq_rx expects a struct mtk_eth * (matching the request_irq
cookie), but mtk_poll_controller incorrectly passed the net_device *.
Calling ndo_poll_controller with CONFIG_NET_POLL_CONTROLLER enabled
would then crash.

## Affected

- `Linux >= 8186f6e382d8719d0a4bc0ef218c4dd7cf55b496 < a9133c4d335e48ba92f4daed10c506378924f976`
- `Linux >= 8186f6e382d8719d0a4bc0ef218c4dd7cf55b496 < 3bd58ac9ca0c552651f533c1bd280dd19ae7d4e8`
- `Linux >= 8186f6e382d8719d0a4bc0ef218c4dd7cf55b496 < 276f1f180f55d56cf5992a581e20ed2b3dfa6ced`
- `Linux >= 8186f6e382d8719d0a4bc0ef218c4dd7cf55b496 < 7eb46318d53940dab63dea7130e720b67a656104`
- `Linux >= 8186f6e382d8719d0a4bc0ef218c4dd7cf55b496 < e095f249e2209674f6366f6db0383a2b96e19239`
- `Linux 4.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.