Null Pointer Vulnerability in Linux Kernel's FTGMAC100 Driver

CVE-2025-38726

What is CVE-2025-38726?

A vulnerability exists in the FTGMAC100 driver of the Linux kernel, where a NULL pointer access could occur during the disconnection of a PHY device. Specifically, after the phy_disconnect() call, the network device's phydev is set to NULL, which could lead to invalid memory access and potential system instability. The vulnerability has been addressed by ensuring that the phy_device is cached before invoking the fixed_phy_unregister() function, effectively preventing such access issues.

References