Executive brief
A vulnerability in the Linux kernel's networking component could allow a local user to crash the system. The issue occurs when the system runs out of memory while processing network interface information, leading to a 'kernel panic' or total system freeze. This primarily affects system availability and could disrupt operations on impacted servers or devices.
Technical details
A NULL pointer dereference exists in the 'phy_reply_size' function within 'net/ethtool/phy.c'. The root cause is a failure to check the return value of 'kstrdup()' calls in 'phy_prepare_data()'. When the system is under memory pressure and 'kstrdup' fails, it returns a NULL pointer that is subsequently passed to 'strlen()' in 'phy_reply_size()', triggering a kernel panic. An attacker with local access could potentially trigger this path via ethtool netlink queries. The vulnerability has been addressed by adding proper NULL checks and centralized error handling to ensure resources are freed and errors are reported correctly.
Affected products
- Linux Linux Kernel 6.16 to 6.18.34, 7.0.11
Timeline
- 2026-05-08: patched: Initial fix committed to mainline kernel
- 2026-07-19: disclosed: CVE published to NVD