CVE-2026-64228 net: ethtool: phy: avoid NULL deref when PHY driver is unbound
A local attacker can cause a kernel crash by unbinding a PHY driver while it is still attached, leading to a null pointer dereference in the ethtool subsystem.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64228?
CVE-2026-64228 is a medium-severity vulnerability in Linux kernel, published on 24 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: ethtool: phy: avoid NULL deref when PHY driver is unbound
phydev->drv can become NULL while the phy_device is still attached to its net_device, namely after the PHY driver is unbound via sysfs:
echo <mdio_id> > /sys/bus/mdio_bus/drivers/<phy_drv>/unbind
phy_remove() clears phydev->drv but doesn't call phy_detach(), so the phy_device stays in the link topology xarray and ethnl_req_get_phydev() still hands it back. ETHTOOL_MSG_PHY_GET then oopses on:
rep_data->drvname = kstrdup(phydev->drv->name, GFP_KERNEL);
drvname is already treated as optional by phy_reply_size(), phy_fill_reply() and phy_cleanup_data(), so just skip the allocation when there is no driver bound.
Weakness: CWE-476
Which versions are affected by CVE-2026-64228?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-64228?
Apply the vendor's patch.
Is CVE-2026-64228 being exploited?
There is no known exploitation of CVE-2026-64228 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-64228, DEBIAN-CVE-2026-64228, GHSA-wx96-hrff-2rc8, ROOT-OS-UBUNTU-2204-CVE-2026-64228, UBUNTU-CVE-2026-64228.