CVE-2025-38726

What it actually does

Potential NULL pointer dereference in the ftgmac100 network driver when phy_disconnect resets netdev->phydev to NULL before fixed_phy_unregister is invoked.

Why it matters to the business

Systems using the affected network hardware may experience kernel crashes or denial of service during routine PHY disconnect operations, leading to unplanned downtime and requiring restarts.

How an attack unfolds

An attacker with the ability to trigger network interface teardown or PHY state changes on affected hardware causes the driver to call fixed_phy_unregister with a NULL argument, resulting in a kernel panic.

How to fix it

Update the Linux kernel to a version containing commit ae59ec969c07c73f0610f8bd7e648f01e798d222 or apply the equivalent package update such as elasticsearch-9.1 to 9.1.4-r0.

How to confirm the fix worked

Verify the presence of the fix by checking the kernel source for the phy_device caching change before phy_disconnect, or confirm the running kernel includes the referenced commit.

Typical attack path

1. Identify systems running vulnerable Linux kernel with ftgmac100 driver enabled
2. Trigger PHY disconnect sequence via interface down or module unload
3. Cause fixed_phy_unregister to receive NULL pointer
4. Trigger kernel NULL dereference and system crash

How to detect it

Review kernel logs for NULL pointer dereference oops messages involving ftgmac100_phy_disconnect or fixed_phy_unregister around the time of network interface changes.

What your security team should do

• Apply the kernel fix or package upgrade immediately on all affected systems
• Prioritize systems with ftgmac100 hardware in production environments
• Monitor for kernel oops or panic events related to the network driver