NULL Dereference Vulnerability in Linux Kernel's Ethtool for Phy Drivers

CVE-2026-64228

What is CVE-2026-64228?

A vulnerability in the Linux kernel's Ethtool allows for a NULL dereference to occur when the PHY driver is unbound. This situation may arise after executing the unbind operation via sysfs, which simultaneously detaches the phy_device from its net_device without properly invoking phy_detach(). As a result, the phy_device remains linkable, leading to potential system instability when attempting to access driver-specific data. The fix ensures that allocation of driver names is skipped unless a valid driver is bound, thereby preventing crashes related to this dereference.

References