External risk intelligence

Linux Kernel MTK Ethernet driver crash vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-80694

This vulnerability exists within the Linux kernel networking driver for specific MediaTek SoC hardware, specifically related to interrupt handling during polling. Such kernel-level networking functions are internal system components and are not directly exposed to or reachable from the public internet.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability was identified in the Linux kernel's network handling for certain MediaTek devices, specifically concerning how interrupts are managed during network polling. While the potential impact is severe, this issue is confined to internal system operations and not directly exposed externally. The primary concern is to confirm if your specific Linux kernel configurations are affected.

Kernel bug affects network interrupt handling.
It impacts internal system operations.
Confirm relevance and exposure of your systems.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by triggering a network polling function within the Linux kernel. This function, when improperly configured, calls another function with incorrect data, leading to a system crash. The vulnerability is in the network driver for certain MediaTek SoCs.

Requires specific kernel configuration.
Triggered by network polling function.
Leads to system crash.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, this vulnerability could cause a system crash when the network controller's interrupt handling is polled. This impacts the availability of the affected system.

System stability and availability.
Malformed network data could trigger a crash.
Denial of service to system resources.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects the Linux kernel's network driver for MediaTek SoCs. The immediate priority is to identify all systems running the affected kernel, confirm their exposure and criticality, and then assign ownership for remediation, potentially involving infrastructure or platform teams.

Confirm affected Linux kernel instances.
Verify reachability and business criticality.
Assign remediation ownership and plan.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the mtk_eth_soc driver in the Linux kernel?

This component is a networking driver designed for specific MediaTek System-on-Chip (SoC) hardware. It facilitates communication between the Linux operating system and the integrated Ethernet hardware, managing tasks like data transmission and interrupt handling to ensure network connectivity on devices that utilize these specific processors.

How does CVE-2026-80694 cause a system crash?

The vulnerability involves a type mismatch in the driver's code. During a specific network polling process, the software passes incorrect information to a function responsible for handling interrupts. Because the function receives an unexpected data structure, the kernel encounters an error it cannot resolve, leading to a system crash and loss of availability.

Do I need specific kernel settings for this bug to trigger?

Yes. The crash only occurs if the system is running with the CONFIG_NET_POLL_CONTROLLER configuration enabled. If your Linux kernel is compiled without this specific polling support, the affected code path is not exercised, and the system is not susceptible to this particular crash trigger.

Is CVE-2026-80694 reachable from the internet?

According to Halo Surface Signal, it is very unlikely. This vulnerability exists deep within kernel-level networking functions used for internal system hardware management. Because these functions are not designed to interface directly with external network traffic, they are generally not reachable from the public internet.

How should I respond to this Linux kernel vulnerability?

Start by auditing your infrastructure to identify which systems use MediaTek SoC hardware and verify if they are compiled with CONFIG_NET_POLL_CONTROLLER enabled. Once identified, prioritize these systems based on their business criticality, assign remediation tasks to your platform or infrastructure teams, and plan for kernel updates as they become available.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.