https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 16:41:26 +0000 https://vulnerability.circl.lu/vuln/cve-2026-64120 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net: ethtool: fix NULL pointer dereference in phy_reply_size</p> <p>In phy_prepare_data(), several strings such as &#39;name&#39;, &#39;drvname&#39;, &#39;upstream_sfp_name&#39;, and &#39;downstream_sfp_name&#39; are allocated using kstrdup(). However, these allocations were not checked for failure.</p> <p>If kstrdup() fails for &#39;name&#39;, it returns NULL while the function continues. This leads to a kernel NULL pointer dereference and panic later in phy_reply_size() when it unconditionally calls strlen() on the NULL pointer.</p> <p>While other strings like &#39;upstream_sfp_name&#39; might be checked before access in certain code paths, failing to handle these allocations consistently can lead to incomplete data reporting or hidden bugs.</p> <p>Fix this by adding proper NULL checks for all kstrdup() calls in phy_prepare_data() and implement a centralized error handling path using goto labels to ensure all previously allocated resources are freed on failure.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net: ethtool: fix NULL pointer dereference in phy_reply_size</p> <p>In phy_prepare_data(), several strings such as &#39;name&#39;, &#39;drvname&#39;, &#39;upstream_sfp_name&#39;, and &#39;downstream_sfp_name&#39; are allocated using kstrdup(). However, these allocations were not checked for failure.</p> <p>If kstrdup() fails for &#39;name&#39;, it returns NULL while the function continues. This leads to a kernel NULL pointer dereference and panic later in phy_reply_size() when it unconditionally calls strlen() on the NULL pointer.</p> <p>While other strings like &#39;upstream_sfp_name&#39; might be checked before access in certain code paths, failing to handle these allocations consistently can lead to incomplete data reporting or hidden bugs.</p> <p>Fix this by adding proper NULL checks for all kstrdup() calls in phy_prepare_data() and implement a centralized error handling path using goto labels to ensure all previously allocated resources are freed on failure.</p> https://vulnerability.circl.lu/vuln/cve-2026-64120