CVE-2026-64120

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: ethtool: fix NULL pointer dereference in phy_reply_size<br /> <br /> In phy_prepare_data(), several strings such as &amp;#39;name&amp;#39;, &amp;#39;drvname&amp;#39;,<br /> &amp;#39;upstream_sfp_name&amp;#39;, and &amp;#39;downstream_sfp_name&amp;#39; are allocated using<br /> kstrdup(). However, these allocations were not checked for failure.<br /> <br /> If kstrdup() fails for &amp;#39;name&amp;#39;, it returns NULL while the function<br /> continues. This leads to a kernel NULL pointer dereference and panic<br /> later in phy_reply_size() when it unconditionally calls strlen() on<br /> the NULL pointer.<br /> <br /> While other strings like &amp;#39;upstream_sfp_name&amp;#39; might be checked before<br /> access in certain code paths, failing to handle these allocations<br /> consistently can lead to incomplete data reporting or hidden bugs.<br /> <br /> Fix this by adding proper NULL checks for all kstrdup() calls in<br /> phy_prepare_data() and implement a centralized error handling path<br /> using goto labels to ensure all previously allocated resources are<br /> freed on failure.