CVE-2026-64228 - Vulnerability Details

- net: ethtool: phy: avoid NULL deref when PHY driver is unbound

Description

In the Linux kernel, the following vulnerability has been resolved:

net: ethtool: phy: avoid NULL deref when PHY driver is unbound

phydev->drv can become NULL while the phy_device is still attached to
its net_device, namely after the PHY driver is unbound via sysfs:

echo <mdio_id> > /sys/bus/mdio_bus/drivers/<phy_drv>/unbind

phy_remove() clears phydev->drv but doesn't call phy_detach(), so the
phy_device stays in the link topology xarray and ethnl_req_get_phydev()
still hands it back. ETHTOOL_MSG_PHY_GET then oopses on:

rep_data->drvname = kstrdup(phydev->drv->name, GFP_KERNEL);

drvname is already treated as optional by phy_reply_size(),
phy_fill_reply() and phy_cleanup_data(), so just skip the allocation
when there is no driver bound.

Published: 2026-07-24

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The kernel contains a null pointer dereference in the ethtool PHY handling code when a PHY driver is unbound via sysfs. After the unbind operation, the driver pointer becomes null while the PHY device remains attached to the network device. When an ETHTOOL_MSG_PHY_GET request is processed, the code attempts to duplicate the driver name from the null pointer, causing a kernel oops. Based on the description, it can be inferred that any user with write permissions to the unbind file could potentially trigger the vulnerability leading to a crash. This is a classic CWE‑476 null pointer dereference that results in a system crash for any user able to trigger the unbind operation.

Affected Systems

All Linux kernel variants that expose the ethtool PHY handling code to sysfs and allow a driver to be unbound through the /sys/bus/mdio_bus/drivers/<phy_drv>/unbind interface are potentially affected. The patch commit identifiers are listed in the references, but no specific kernel version is named in the data, so any kernel still containing the described bug and enabling the unbind operation may be vulnerable.

Risk and Exploitability

The CVSS score of 5.5 points to a medium severity vulnerability. The EPSS score of <1% indicates a very low likelihood of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local privileged access to write to the unbind file in sysfs; no remote or local privilege escalation vector is described. The impact is a denial of service due to a kernel crash, but overall risk is low because of the low exploit probability.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`9dd2ad5e92b962d1349a7541d167e8e214e49f95`	affected	< 3586924625559e6f9876d726c80ff0a75f0d5849
`9dd2ad5e92b962d1349a7541d167e8e214e49f95`	affected	< 17fe2381f967d353183f374a1c0181a6d194158c
`9dd2ad5e92b962d1349a7541d167e8e214e49f95`	affected	< e3adf69f8eb121a9128c2b0029efd050d3649153

Linux

affected

Version	Status	Constraints
`6.16`	affected	—
`0`	unaffected	< 6.16
`6.18.34`	unaffected	≤ 6.18.*
`7.0.11`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc2::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc3::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[9dd2ad5e92b962d1349a7541d167e8e214e49f95,3586924625559e6f9876d726c80ff0a75f0d5849)`	affected	code_commit	—
`[9dd2ad5e92b962d1349a7541d167e8e214e49f95,17fe2381f967d353183f374a1c0181a6d194158c)`	affected	code_commit	—
`[9dd2ad5e92b962d1349a7541d167e8e214e49f95,e3adf69f8eb121a9128c2b0029efd050d3649153)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.16`	affected	semver	—
`[0,6.16)`	unaffected	semver	—
`[6.18.34,6.19.0)`	unaffected	semver	—
`[7.0.11,7.1.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the latest Linux kernel that contains the ethtool PHY NULL dereference fix.
Restrict write permissions on /sys/bus/mdio_bus/drivers/<phy_drv>/unbind to privileged users, or enforce an ACL so only authorized users can perform the unbind operation.
Configure auditd or a similar logging mechanism to record any attempts to write to the unbind file, enabling detection of potential misuse.

Generated by OpenCVE AI on August 5, 2026 at 00:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8618-1	Linux kernel vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00166.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/17fe2381f967d353183f374a1c0181a6d194158c
https://git.kernel.org/stable/c/3586924625559e6f9876d726c80ff0a75f0d5849
https://git.kernel.org/stable/c/e3adf69f8eb121a9128c2b0029efd050d3649153
https://lore.kernel.org/linux-cve-announce/2026072418-CVE-2026-64228-064a@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64228
https://www.cve.org/CVERecord?id=CVE-2026-64228

History

Thu, 13 Aug 2026 12:15:00 +0000

Type	Values Removed	Values Added
CPEs		cpe:2.3:o:linux:linux_kernel:7.1:rc1:::::: cpe:2.3:o:linux:linux_kernel:7.1:rc2:::::: cpe:2.3:o:linux:linux_kernel:7.1:rc3::::::

Tue, 28 Jul 2026 16:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476
References		https://lore.kernel.org/linux-cve-announce/2026072418-CVE-2026-64228-064a@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64228 https://www.cve.org/CVERecord?id=CVE-2026-64228
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Fri, 24 Jul 2026 18:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net: ethtool: phy: avoid NULL deref when PHY driver is unbound phydev->drv can become NULL while the phy_device is still attached to its net_device, namely after the PHY driver is unbound via sysfs: echo <mdio_id> > /sys/bus/mdio_bus/drivers/<phy_drv>/unbind phy_remove() clears phydev->drv but doesn't call phy_detach(), so the phy_device stays in the link topology xarray and ethnl_req_get_phydev() still hands it back. ETHTOOL_MSG_PHY_GET then oopses on: rep_data->drvname = kstrdup(phydev->drv->name, GFP_KERNEL); drvname is already treated as optional by phy_reply_size(), phy_fill_reply() and phy_cleanup_data(), so just skip the allocation when there is no driver bound.
Title		net: ethtool: phy: avoid NULL deref when PHY driver is unbound
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/17fe2381f967d353183f374a1c0181a6d194158c https://git.kernel.org/stable/c/3586924625559e6f9876d726c80ff0a75f0d5849 https://git.kernel.org/stable/c/e3adf69f8eb121a9128c2b0029efd050d3649153

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-24T15:23:11.510Z

Updated: 2026-07-24T15:23:11.510Z

Reserved: 2026-07-19T15:36:31.771Z

Link: CVE-2026-64228

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-07-24T16:16:51.913

Modified: 2026-08-13T12:00:31.287

Link: CVE-2026-64228

Redhat

Severity : Low

Publid Date: 2026-07-24T00:00:00Z

Links: CVE-2026-64228 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-05T01:00:07Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object