CVE-2026-64228
Received Received - Intake

NULL Dereference in Linux Kernel PHY Subsystem

Publication date: 2026-07-24

Last updated on: 2026-07-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: ethtool: phy: avoid NULL deref when PHY driver is unbound phydev->drv can become NULL while the phy_device is still attached to its net_device, namely after the PHY driver is unbound via sysfs: echo <mdio_id> > /sys/bus/mdio_bus/drivers/<phy_drv>/unbind phy_remove() clears phydev->drv but doesn't call phy_detach(), so the phy_device stays in the link topology xarray and ethnl_req_get_phydev() still hands it back. ETHTOOL_MSG_PHY_GET then oopses on: rep_data->drvname = kstrdup(phydev->drv->name, GFP_KERNEL); drvname is already treated as optional by phy_reply_size(), phy_fill_reply() and phy_cleanup_data(), so just skip the allocation when there is no driver bound.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-24
Last Modified
2026-07-24
Generated
2026-07-24
AI Q&A
2026-07-24
EPSS Evaluated
N/A
NVD
CVE-2026-64228
EUVD
EUVD-2026-48636

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel occurs when a PHY driver is unbound while still attached to a network device. The phydev->drv pointer becomes NULL, but the phy_device remains linked to the network device. When ETHTOOL_MSG_PHY_GET tries to access phydev->drv->name, it causes a NULL pointer dereference and kernel oops.

Detection Guidance

This vulnerability may cause a kernel oops when accessing ETHTOOL_MSG_PHY_GET on a PHY device with an unbound driver. Check kernel logs for NULL pointer dereference errors related to phydev->drv or ethtool operations. Monitor sysfs unbind operations under /sys/bus/mdio_bus/drivers/ for unexpected driver unbinding.

Impact Analysis

This vulnerability can cause system crashes (kernel oops) when attempting to query PHY device information via ethtool. It may lead to denial of service if the affected system becomes unresponsive or requires a reboot.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel issue involving a NULL dereference in the ethtool PHY driver subsystem, which could lead to system crashes or instability but does not involve data exposure or privacy violations.

Mitigation Strategies

Apply the Linux kernel patch that resolves this issue. Avoid unbinding PHY drivers via sysfs while the interface is active. Monitor and restrict access to /sys/bus/mdio_bus/drivers/ to prevent malicious unbind operations. Update ethtool and kernel to versions containing the fix.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64228. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart