Linux Kernel CVE-2026-64120

The vulnerability resides in the Linux kernel's ethtool netlink subsystem under net/ethtool, specifically in the code path that prepares PHY (physical layer) device data for netlink replies. phy_prepare_data() uses kstrdup() - a kernel-space string duplication function that can legitimately return NULL under memory pressure - to allocate string fields including device name, driver name, and SFP upstream/downstream names. Without NULL-checks on these allocations, execution falls through to phy_reply_size(), which unconditionally calls strlen() on what may be a NULL pointer. On all major Linux architectures, a NULL pointer dereference in kernel context produces an oops and typically a kernel panic, crashing the system. The root cause class is CWE-476 (NULL Pointer Dereference), a pervasive class of defect in C-language kernel code arising from inconsistent allocation-failure handling. The affected CPE is cpe:2.3:a:linux:linux:* across kernel versions from the introducing commit (9dd2ad5e92b962d1349a7541d167e8e214e49f95) up to the stable-branch fixes in 6.18.34, 7.0.11, and mainline 7.1. The fix introduces explicit NULL checks on each kstrdup() return and a centralized goto-based cleanup path to free all previously allocated resources on any allocation failure.