CVE-2026-80993net: phylink: correctly validate returned PCS in phylink_inband_caps
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: net: phylink: correctly validate returned PCS in phylink_inband_caps In phylink_inband_caps(), the PCS returned by mac_select_pcs is only checked if NULL but mac_select_pcs can also return an error pointer. This can cause a kernel panic as phylink_pcs_inband_caps() only checks if passed PCS is not NULL and directly dereference ops from the phylink_pcs struct. Use the IS_ERR_OR_NULL macro to address both case where the returned PCS can be NULL or an error pointer and prevent a kernel panic.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 11, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from df874f9e52c340cc6f0a0014a97b778f67d46849 before b6b533f83461c3730875cf3ed5ff6362dcb67be9; from df874f9e52c340cc6f0a0014a97b778f67d46849 before fb4d77553841ae85bed9b2cf03351c401e871d85; from df874f9e52c340cc6f0a0014a97b778f67d46849 before f2849b1fd059ec9b3281b771e6ac5aad9feee851 | CNA record |
References
- https://git.kernel.org/stable/c/b6b533f83461c3730875cf3ed5ff6362dcb67be9
- https://git.kernel.org/stable/c/fb4d77553841ae85bed9b2cf03351c401e871d85
- https://git.kernel.org/stable/c/f2849b1fd059ec9b3281b771e6ac5aad9feee851
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.