SB20260727359 - NULL pointer dereference in Linux kernel ethtool

Description

This security bulletin contains information about 1 vulnerability.

1) NULL pointer dereference (CVE-ID: CVE-2026-64228)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in net/ethtool/phy.c when handling ETHTOOL_MSG_PHY_GET requests for a phy_device whose PHY driver has been unbound. A local user can unbind the PHY driver via sysfs and trigger the request to cause a denial of service.

The issue occurs because the phy_device can remain attached to its net_device after the PHY driver is unbound, leaving the device reachable through the link topology xarray.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/17fe2381f967d353183f374a1c0181a6d194158c
• https://git.kernel.org/stable/c/3586924625559e6f9876d726c80ff0a75f0d5849
• https://git.kernel.org/stable/c/e3adf69f8eb121a9128c2b0029efd050d3649153