CVE-2026-64120: Linux Kernel NULL Pointer Vulnerability

CVE-2026-64120 Overview

CVE-2026-64120 is a NULL pointer dereference vulnerability in the Linux kernel's ethtool subsystem. The flaw resides in the phy_prepare_data() function within the network PHY (Physical Layer) handling code. Several string allocations using kstrdup() for fields such as name, drvname, upstream_sfp_name, and downstream_sfp_name did not check for allocation failure. When kstrdup() returns NULL, execution continues and phy_reply_size() later calls strlen() on the NULL pointer, causing a kernel panic. The issue has been resolved upstream in the Linux kernel stable tree.

Critical Impact
A local unprivileged trigger of allocation failure in phy_prepare_data() leads to a kernel NULL pointer dereference and a system panic, resulting in denial of service.

Affected Products

Linux kernel versions containing the vulnerable phy_prepare_data() implementation in net/ethtool
Linux distributions shipping the affected ethtool PHY code paths
Systems using PHY devices queried via ethtool netlink interfaces

Discovery Timeline

2026-07-19 - CVE-2026-64120 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-64120

Vulnerability Analysis

The vulnerability exists in the Linux kernel ethtool netlink code that prepares PHY reply data for user-space queries. Inside phy_prepare_data(), the kernel duplicates several device-related strings using kstrdup(). These include the PHY name, driver name (drvname), and Small Form-factor Pluggable transceiver names (upstream_sfp_name, downstream_sfp_name).

The original code did not verify that kstrdup() succeeded. Under memory pressure, kstrdup() returns NULL. The function nonetheless continued and stored the NULL result. Later, phy_reply_size() unconditionally invoked strlen() on these pointers to compute the reply payload size, dereferencing NULL and triggering a kernel oops or panic.

This class of defect is a Null Pointer Dereference leading to Denial of Service. Inconsistent NULL handling across the allocation set also risked incomplete data reporting and latent bugs in adjacent code paths.

Root Cause

The root cause is missing return-value validation for multiple kstrdup() allocations in phy_prepare_data(). Kernel allocation helpers can return NULL when memory is scarce. The absence of centralized error handling meant partially initialized state propagated to consumers such as phy_reply_size(), which assumed non-NULL string pointers.

Attack Vector

Triggering the fault requires reaching the ethtool PHY reply preparation path while an allocation fails. Local users interacting with network interfaces via the ethtool netlink interface can invoke the affected code. Under low-memory conditions or crafted allocation-failure scenarios, the NULL dereference occurs and panics the kernel, yielding a local denial of service.

The vulnerability is described in prose because no verified public exploit code is available. Refer to the upstream commits for the exact code paths and the corrected error-handling flow using goto cleanup labels.

Detection Methods for CVE-2026-64120

Indicators of Compromise

Kernel oops or panic entries in dmesg referencing phy_reply_size or phy_prepare_data on the call stack
strlen faulting on a NULL address within ethtool netlink handling
Unexpected reboots or system hangs correlated with ethtool queries against PHY or SFP devices

Detection Strategies

Compare running kernel versions against fixed commits 3dbe20a3809347bacda890822e7ca013bd85a18c, 4908f1395fb1b832ceec11584af649874a2732ea, and 61f53c1e58d68723bc1db10912a53f1991f08719
Monitor kernel logs for BUG: kernel NULL pointer dereference messages containing ethtool PHY symbols
Audit crash dumps for panics originating in net/ethtool/phy.c code paths

Monitoring Recommendations

Forward dmesg and /var/log/kern.log to a centralized log platform for pattern matching on kernel oops signatures
Track host stability metrics, correlating panics with ethtool or netlink activity from unprivileged processes
Alert on repeated allocation-failure warnings preceding ethtool operations, which may indicate exploitation attempts under induced memory pressure

How to Mitigate CVE-2026-64120

Immediate Actions Required

Update to a Linux kernel version that includes the upstream fix commits listed in the Linux Kernel Commit Update
Apply distribution vendor kernel updates as they become available for supported stable branches
Restrict local access to systems that cannot be immediately patched to reduce exposure to the local trigger path

Patch Information

The fix adds NULL checks after every kstrdup() call in phy_prepare_data() and centralizes cleanup with goto labels so previously allocated strings are freed on any failure. The corrected code is available in the upstream commits: 3dbe20a, 4908f13, and 61f53c1.

Workarounds

Limit unprivileged local access to hosts pending patch deployment, since the trigger path is reachable from local users invoking ethtool operations
Avoid running workloads that induce sustained low-memory conditions on unpatched kernels, as allocation failures are required for the NULL dereference to occur
Restrict use of ethtool netlink queries against PHY and SFP devices on unpatched systems where feasible

bash

# Verify the running kernel version and check for the fix
uname -r

# On distributions using package managers, apply the vendor kernel update
# Debian/Ubuntu
sudo apt update && sudo apt install --only-upgrade linux-image-$(uname -r)

# RHEL/Rocky/Alma
sudo dnf update kernel

# Reboot to activate the patched kernel
sudo systemctl reboot