PT-2026-64343 · Linux · Linux

CVE-2026-64228

·

Published

2026-07-24

·

Updated

2026-07-24

None

No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
net: ethtool: phy: avoid NULL deref when PHY driver is unbound
phydev->drv can become NULL while the phy device is still attached to its net device, namely after the PHY driver is unbound via sysfs:
echo <mdio id> > /sys/bus/mdio bus/drivers/<phy drv>/unbind
phy remove() clears phydev->drv but doesn't call phy detach(), so the phy device stays in the link topology xarray and ethnl req get phydev() still hands it back. ETHTOOL MSG PHY GET then oopses on:
rep data->drvname = kstrdup(phydev->drv->name, GFP KERNEL);
drvname is already treated as optional by phy reply size(), phy fill reply() and phy cleanup data(), so just skip the allocation when there is no driver bound.
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Related Identifiers

CVE-2026-64228

Affected Products

Linux