Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-64228

net: ethtool: phy: avoid NULL deref when PHY driver is unbound

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: net: ethtool: phy: avoid NULL deref when PHY driver is unbound phydev->drv can become NULL while the phy_device is still attached to its net_device, namely after the PHY driver is unbound via sysfs: echo <mdio_id> > /sys/bus/mdio_bus/drivers/<phy_drv>/unbind phy_remove() clears phydev->drv but doesn't call phy_detach(), so the phy_device stays in the link topology xarray and ethnl_req_get_phydev() still hands it back. ETHTOOL_MSG_PHY_GET then oopses on: rep_data->drvname = kstrdup(phydev->drv->name, GFP_KERNEL); drvname is already treated as optional by phy_reply_size(), phy_fill_reply() and phy_cleanup_data(), so just skip the allocation when there is no driver bound.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 9dd2ad5e92b962d1349a7541d167e8e214e49f95 to < 3586924625559e6f9876d726c80ff0a75f0d5849affected
  • 9dd2ad5e92b962d1349a7541d167e8e214e49f95 to < 17fe2381f967d353183f374a1c0181a6d194158caffected
  • 9dd2ad5e92b962d1349a7541d167e8e214e49f95 to < e3adf69f8eb121a9128c2b0029efd050d3649153affected

Linux Linux

Default version status: affected

  • 6.16affected
  • 0 to < 6.16unaffected
  • 6.18.34 to ≤ 6.18.*unaffected
  • 7.0.11 to ≤ 7.0.*unaffected
  • 7.1 to ≤ *unaffected

References