Linux Kernel CVE-2026-64120

Exploitation requires local system access with at minimum low-privilege credentials (CVSS PR:L). The target system must have network interfaces with PHY devices that expose SFP or upstream/downstream PHY data via the ethtool netlink interface - typically wired Ethernet NICs with SFP cages or managed PHY chips. Crucially, exploitation also requires a kstrdup() memory allocation failure to occur during the PHY data query; this typically happens under genuine kernel memory pressure (e.g., OOM conditions or memory exhaustion) rather than on demand. Limiting factors are: the attack is strictly local (AV:L - no remote network vector exists), the attacker cannot guarantee triggering the allocation failure without independently inducing memory pressure, and the impact is availability-only (kernel panic with no code execution, privilege escalation, or data disclosure). Most standard Linux distributions do not restrict ethtool queries from local low-privilege users by default, meaning any authenticated local user on an affected kernel interacting with a PHY-capable NIC during a memory-constrained event is the realistic threat actor.

The official CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, score 5.5) accurately characterizes the risk profile: local access, low privileges required, and exclusively an availability impact. EPSS at 0.17% in the 6th percentile provides strong signal that exploitation has not been observed and that widespread weaponization is unlikely in the near term. The vulnerability is not listed in CISA KEV, and no proof-of-concept code appears in any referenced source. Practical exploitation also carries a non-trivial precondition: the attacker must cause kstrdup() to return NULL, which typically requires the system to be under genuine memory pressure - this is not a simple one-shot trigger, which further limits real-world exploitability despite AC:L in the CVSS (AC:L reflects that no special configuration is required on the attacker's part, not that the memory condition is guaranteed). The impact - a kernel panic - is severe in multi-user or shared infrastructure contexts such as hosting environments or HPC clusters, where even a mid-sized municipal IT team in inowroclaw running shared Linux servers should treat this as a routine patching item rather than an emergency. No conflicting signals exist between data sources: CVSS, EPSS, and KEV status all consistently indicate a low-urgency, local, availability-only issue with no confidentiality or integrity implications. SSVC disposition for most organizations would be 'Track' - apply in the next regular patching cycle.

A local user with standard shell access on a multi-user Linux system (e.g., a shared hosting server or HPC login node) running an affected kernel version initiates an ethtool PHY data query against a wired network interface while the system is under memory pressure. The kstrdup() call for the PHY device name fails and returns NULL, but phy_prepare_data() continues without error handling. When phy_reply_size() calls strlen() on the resulting NULL pointer, the kernel triggers a NULL dereference oops, causing a system-wide panic and crash. No public proof-of-concept exploit code has been identified, and reliably inducing memory allocation failure adds meaningful practical difficulty.