CVE-2026-64228: Linux Kernel PHY Driver NULL Deref Flaw

CVE-2026-64228 Overview

CVE-2026-64228 is a NULL pointer dereference vulnerability in the Linux kernel's ethtool PHY (physical layer) subsystem. The flaw occurs when a PHY driver is unbound via sysfs while the phy_device remains attached to its net_device. After unbinding, phydev->drv becomes NULL, but the device stays present in the link topology xarray. A subsequent ETHTOOL_MSG_PHY_GET netlink request dereferences the now-NULL driver pointer through phydev->drv->name, triggering a kernel oops.

Critical Impact
A local user with sufficient privileges to unbind PHY drivers via sysfs can trigger a kernel NULL pointer dereference, causing a denial of service on the affected system.

Affected Products

Linux kernel net/ethtool/phy.c subsystem
Systems using PHY devices bound via the mdio_bus driver framework
Kernel builds prior to the fixes referenced in commits 17fe2381f967, 358692462555, and e3adf69f8eb1

Discovery Timeline

2026-07-24 - CVE-2026-64228 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64228

Vulnerability Analysis

The vulnerability resides in the ethtool PHY netlink interface used to query PHY driver information from userspace. When userspace unbinds a PHY driver through sysfs, the kernel invokes phy_remove(), which clears the phydev->drv pointer. However, phy_remove() does not call phy_detach(), so the phy_device structure remains registered in the link topology xarray. Subsequent lookups via ethnl_req_get_phydev() continue to return the orphaned device.

When ETHTOOL_MSG_PHY_GET is processed, the handler attempts to duplicate the driver name string via kstrdup(phydev->drv->name, GFP_KERNEL). Because phydev->drv is NULL, this dereference triggers a kernel oops, resulting in a denial of service condition. The drvname field is already treated as optional by phy_reply_size(), phy_fill_reply(), and phy_cleanup_data(), which the upstream fix leverages.

Root Cause

The root cause is an inconsistent state between two kernel subsystems. phy_remove() clears the driver pointer without removing the phy_device from the ethtool link topology xarray. The netlink handler assumes any device returned by ethnl_req_get_phydev() has a valid drv pointer, so it performs an unchecked dereference on optional data.

Attack Vector

The issue is triggered by a local operation. An actor with permission to write to /sys/bus/mdio_bus/drivers/<phy_drv>/unbind unbinds the PHY driver, then issues an ETHTOOL_MSG_PHY_GET netlink message against the affected interface. The unbind command follows this pattern:

echo <mdio_id> > /sys/bus/mdio_bus/drivers/<phy_drv>/unbind

After the unbind, any userspace program that queries PHY information through ethtool netlink causes the kernel to dereference the NULL phydev->drv inside kstrdup(phydev->drv->name, GFP_KERNEL) and oops.

Detection Methods for CVE-2026-64228

Indicators of Compromise

Kernel oops messages referencing kstrdup or phy_fill_reply in dmesg or /var/log/kern.log
Unexpected writes to /sys/bus/mdio_bus/drivers/*/unbind in audit logs
Ethtool netlink requests (ETHTOOL_MSG_PHY_GET) issued immediately after PHY driver unbind operations

Detection Strategies

Enable Linux audit rules (auditctl -w /sys/bus/mdio_bus/drivers -p wa) to capture unbind operations on PHY drivers
Correlate kernel oops events with preceding sysfs writes to identify exploitation attempts
Monitor netlink traffic on NETLINK_GENERIC for ETHTOOL_MSG_PHY_GET requests originating from unexpected processes

Monitoring Recommendations

Alert on any process modifying files under /sys/bus/mdio_bus/drivers/ that is not part of expected system administration workflows
Track kernel panic and oops counters via /proc/sys/kernel/tainted and centralized log ingestion
Baseline the set of processes that legitimately issue ethtool netlink requests and flag deviations

How to Mitigate CVE-2026-64228

Immediate Actions Required

Apply the upstream kernel patches referenced in the stable commit 17fe2381f967, commit 3586924625559, and commit e3adf69f8eb12
Rebuild and deploy kernels for all Linux hosts that expose PHY devices, particularly network appliances and embedded systems
Restrict write access to /sys/bus/mdio_bus/drivers/ to root and trusted administrative accounts only

Patch Information

The upstream fix skips the kstrdup call when phydev->drv is NULL, relying on the existing optional handling of drvname in phy_reply_size(), phy_fill_reply(), and phy_cleanup_data(). Backports are available in the stable trees referenced above. Distribution kernels should be updated to versions that include these commits.

Workarounds

Avoid unbinding PHY drivers on production systems while network interfaces are active
Use mandatory access control (SELinux, AppArmor) policies to prevent non-root processes from writing to /sys/bus/mdio_bus/drivers/*/unbind
Disable or restrict the ethtool netlink interface for untrusted local users through seccomp or Linux capabilities policies

bash

# Restrict write access to mdio_bus driver unbind entries
chmod 600 /sys/bus/mdio_bus/drivers/*/unbind

# Audit unbind operations
auditctl -w /sys/bus/mdio_bus/drivers -p wa -k phy_unbind