---
cve: "CVE-2026-64228"
severity: "LOW"
cvss: 3.1
epss: "12%"
vendor: "Linux"
kev: false
exploited: false
published: "2026-07-24 15:23:11"
tags: [cve, security, low]
source: tsecurity.de CVE-Dossier
exported: "2026-09-03T07:51:33+02:00"
---

# CVE-2026-64228

> 3.1 LOW

## Beschreibung

In the Linux kernel, the following vulnerability has been resolved:

net: ethtool: phy: avoid NULL deref when PHY driver is unbound

phydev->drv can become NULL while the phy_device is still attached to
its net_device, namely after the PHY driver is unbound via sysfs:

	echo  > /sys/bus/mdio_bus/drivers//unbind

phy_remove() clears phydev->drv but doesn't call phy_detach(), so the
phy_device stays in the link topology xarray and ethnl_req_get_phydev()
still hands it back. ETHTOOL_MSG_PHY_GET then oopses on:

	rep_data->drvname = kstrdup(phydev->drv->name, GFP_KERNEL);

drvname is already treated as optional by phy_reply_size(),
phy_fill_reply() and phy_cleanup_data(), so just skip the allocation
when there is no driver bound.

## Patch verfügbar (OSV)

- Kernel ≥ 6.18.34
- Kernel ≥ 7.0.11

## Referenzen

- <https://git.kernel.org/stable/c/3586924625559e6f9876d726c80ff0a75f0d5849>
- <https://git.kernel.org/stable/c/17fe2381f967d353183f374a1c0181a6d194158c>
- <https://git.kernel.org/stable/c/e3adf69f8eb121a9128c2b0029efd050d3649153>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-64228) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_