CVE-2026-80993: net: phylink: correctly validate returned PCS in phylink_inband_caps
In the Linux kernel, the following vulnerability has been resolved:
net: phylink: correctly validate returned PCS in phylinkinbandcaps
In phylinkinbandcaps(), the PCS returned by macselectpcs is only checked if NULL but macselectpcs can also return an error pointer.
This can cause a kernel panic as phylinkpcsinbandcaps() only checks if passed PCS is not NULL and directly dereference ops from the phylinkpcs struct.
Use the ISERRORNULL macro to address both case where the returned PCS can be NULL or an error pointer and prevent a kernel panic.
Event History
Frequently Asked Questions
What condition is required to trigger the kernel panic?
A MAC driver's mac_select_pcs callback must return an error pointer rather than a valid PCS or NULL while phylink_inband_caps() is handling it. The vulnerable code then passes that error pointer to phylink_pcs_inband_caps(), which dereferences it.
Are systems affected when mac_select_pcs returns NULL?
No, the existing code already checks for NULL. The missing validation is specifically for error-pointer returns from mac_select_pcs.
What can be done if the fix cannot be applied immediately?
The provided data does not identify a configuration workaround. Mitigation would require avoiding the driver or execution path in which mac_select_pcs returns an error pointer until the corrected kernel code is deployed.