CVE-2026-80993: Linux Kernel Use-After-Free Vulnerability

CVE-2026-80993 Overview

CVE-2026-80993 is a Linux kernel vulnerability in the network phylink subsystem. The flaw resides in the phylink_inband_caps() function, which validates the Physical Coding Sublayer (PCS) returned by mac_select_pcs(). The existing code checks only for NULL return values and ignores error pointers. When mac_select_pcs() returns an error pointer, downstream code in phylink_pcs_inband_caps() dereferences the ops field of the phylink_pcs struct, triggering a kernel panic. The fix replaces the NULL check with the IS_ERR_OR_NULL() macro to handle both conditions safely.

Critical Impact
A kernel panic in the networking stack can cause a system-wide denial of service on affected Linux hosts.

Affected Products

Linux kernel versions containing the vulnerable phylink_inband_caps() implementation
Systems using MAC drivers whose mac_select_pcs callback can return an ERR_PTR value
Networking hardware relying on the phylink in-band capability negotiation path

Discovery Timeline

2026-09-11 - CVE-2026-80993 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-80993

Vulnerability Analysis

The phylink subsystem manages the interaction between MAC drivers and physical layer devices in the Linux networking stack. The phylink_inband_caps() function queries in-band signaling capabilities by first calling the MAC driver's mac_select_pcs() callback to obtain a phylink_pcs pointer.

The original validation logic only tested the returned pointer against NULL. Linux kernel convention allows callback functions to signal failure by returning an ERR_PTR encoded error value, which is a valid non-NULL pointer within a reserved address range. When this occurs, the pointer passes the NULL check and flows into phylink_pcs_inband_caps().

Downstream code then dereferences the ops field of the encoded error pointer as if it were a valid struct address. The dereference targets an invalid kernel memory region and triggers a kernel panic, halting the affected CPU or the entire system.

Root Cause

The root cause is incomplete pointer validation, a form of null pointer dereference [CWE-476] combined with improper handling of error return values. The caller assumed mac_select_pcs() returned only valid pointers or NULL, but the kernel API contract permits ERR_PTR returns. The fix replaces if (pcs) style validation with IS_ERR_OR_NULL(pcs) to reject both invalid states before dereference.

Attack Vector

The vulnerability triggers during phylink capability negotiation, typically at interface bring-up or link state changes. Exploitation requires a MAC driver whose mac_select_pcs() implementation returns an ERR_PTR under specific hardware or configuration conditions. A local user or automated process that induces link renegotiation on an affected device can trigger the panic, producing a denial of service. No remote network vector has been documented.

See the upstream fixes at Kernel Git Commit b6b533f, Kernel Git Commit f2849b1, and Kernel Git Commit fb4d775 for the corrected validation logic.

Detection Methods for CVE-2026-80993

Indicators of Compromise

Kernel panic messages referencing phylink_inband_caps or phylink_pcs_inband_caps in the call trace
Unexpected system reboots or network stack failures during interface initialization or PHY link changes
dmesg output showing invalid pointer dereferences originating from the phylink code path

Detection Strategies

Audit installed kernel versions against the fixed commits published on kernel.org
Review MAC driver source for mac_select_pcs implementations that return ERR_PTR values
Correlate host crash telemetry with network interface configuration events to identify recurring panics

Monitoring Recommendations

Forward kernel logs to a centralized logging platform and alert on panic traces containing phylink symbols
Track kernel package versions across the Linux fleet and flag hosts running unpatched builds
Monitor unplanned reboots on systems using affected network adapters for repeat occurrences

How to Mitigate CVE-2026-80993

Immediate Actions Required

Identify Linux hosts running kernel builds that predate the IS_ERR_OR_NULL fix in phylink_inband_caps()
Apply the stable kernel updates published by your distribution vendor as soon as they are available
Prioritize systems using MAC drivers known to return ERR_PTR from mac_select_pcs()

Patch Information

The fix has been merged upstream across multiple stable branches. Reference commits b6b533f83461c3730875cf3ed5ff6362dcb67be9, f2849b1fd059ec9b3281b771e6ac5aad9feee851, and fb4d77553841ae85bed9b2cf03351c401e871d85 on git.kernel.org. Deploy the corresponding stable kernel release from your distribution once available and reboot affected hosts to activate the patched code.

Workarounds

Avoid triggering repeated link renegotiation on affected interfaces until patched kernels are deployed
Where feasible, disable network drivers whose mac_select_pcs callback can return an error pointer
Restrict local user access to interface configuration utilities that can force phylink capability queries

bash

# Verify running kernel version and check for the patched phylink code
uname -r
grep -rn "IS_ERR_OR_NULL" /usr/src/linux/drivers/net/phy/phylink.c