What is the CVSS score of CVE-2026-64228?

CVE-2026-64228 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-64228?

Yes, a patch is available for CVE-2026-64228. Update the affected software to the latest version immediately.

Linux Kernel CVE-2026-64228

EUVD-2026-48636 MEDIUM

NULL Pointer Dereference (CWE-476)

2026-07-24 Linux

GHSA-wx96-hrff-2rc8

Denial Of Service Linux Null Pointer Dereference Red Hat Suse

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

5.5 MEDIUM

Local exploitation via sysfs requires an authenticated shell (PR:L, AV:L); only a kernel panic results, so C and I remain N.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

5.5 LOW

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 12:08 vuln.today

CVSS changed

Aug 13, 2026 - 12:07 NVD

5.5 (MEDIUM)

Patch available

Jul 24, 2026 - 17:48 EUVD

CVE Published

Jul 24, 2026 - 15:23 nvd

MEDIUM 5.5

CVE Published

Jul 24, 2026 - 15:23 cve.org

UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

net: ethtool: phy: avoid NULL deref when PHY driver is unbound

phydev->drv can become NULL while the phy_device is still attached to its net_device, namely after the PHY driver is unbound via sysfs:

echo <mdio_id> > /sys/bus/mdio_bus/drivers/<phy_drv>/unbind

phy_remove() clears phydev->drv but doesn't call phy_detach(), so the phy_device stays in the link topology xarray and ethnl_req_get_phydev() still hands it back. ETHTOOL_MSG_PHY_GET then oopses on:

rep_data->drvname = kstrdup(phydev->drv->name, GFP_KERNEL);

drvname is already treated as optional by phy_reply_size(), phy_fill_reply() and phy_cleanup_data(), so just skip the allocation when there is no driver bound.

AnalysisAI

NULL pointer dereference in the Linux kernel ethtool PHY subsystem allows a local low-privileged user to trigger a kernel panic (denial of service) by unbinding a PHY driver via sysfs while the device remains registered in the ethtool link topology. Affected kernel versions span the 6.16, 6.18.x, 7.0.x, and 7.1 stable branches; upstream fixes are available in commits targeting 6.18.34 and 7.0.11. No public exploit code exists and no active exploitation has been identified at time of analysis, consistent with EPSS at 0.17% (6th percentile).

Technical ContextAI

The flaw resides in the kernel's net/ethtool/phy.c path handling ETHTOOL_MSG_PHY_GET netlink requests. The root cause (CWE-476: NULL Pointer Dereference) is a lifecycle mismatch: phy_remove() zeroes phydev->drv when a PHY driver is unbound via /sys/bus/mdio_bus/drivers/<phy_drv>/unbind, but does not call phy_detach(), so the phy_device object persists in the link topology xarray. When ethnl_req_get_phydev() subsequently retrieves the now-driverless phy_device and the ethtool handler attempts kstrdup(phydev->drv->name, GFP_KERNEL), it dereferences a NULL pointer and oopses. The fix skips the drvname allocation when no driver is bound, consistent with how phy_reply_size(), phy_fill_reply(), and phy_cleanup_data() already treat drvname as optional. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*. The MDIO bus and PHY subsystem are used on systems with physical network interfaces relying on dedicated PHY chips, common in embedded, server, and networking hardware.

RemediationAI

The primary fix is to upgrade to a patched kernel version: Linux 7.0.11 or later, Linux 6.18.34 or later, or Linux 7.1+ (mainline). Upstream stable commits are available at https://git.kernel.org/stable/c/3586924625559e6f9876d726c80ff0a75f0d5849 (7.0.x branch), https://git.kernel.org/stable/c/17fe2381f967d353183f374a1c0181a6d194158c (6.18.x branch), and https://git.kernel.org/stable/c/e3adf69f8eb121a9128c2b0029efd050d3649153 (7.1/mainline). Ubuntu users should apply USN-8618-1 via standard apt package updates. Where immediate kernel patching is not feasible, restrict write access to /sys/bus/mdio_bus/drivers/*/unbind using MAC policy (SELinux file context rules or AppArmor profiles) to prevent unprivileged sysfs unbind operations - note this trade-off reduces runtime PHY driver management flexibility. Alternatively, remove physical access or shell access for untrusted users on systems with MDIO-attached PHY devices.

Same weakness CWE-476 – NULL Pointer Dereference

View all

CVE-2016-0742 HIGH

7.5

CVE-2014-3470 MEDIUM

4.3

CVE-2017-3730 HIGH POC

7.5

CVE-2017-3169 CRITICAL POC

9.8

CVE-2016-4957 HIGH

7.5

CVE-2015-3194 HIGH

7.5

CVE-2026-21525 MEDIUM

6.2

CVE-2017-0016 MEDIUM

5.9

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-64228 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-64228

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-476 – NULL Pointer Dereference

Same technique Denial Of Service

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code