CVE-2026-80993

Not scored yetLast modified Oct 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net: phylink: correctly validate returned PCS in phylink_inband_caps

In phylink_inband_caps(), the PCS returned by mac_select_pcs is only checked if NULL but mac_select_pcs can also return an error pointer.

This can cause a kernel panic as phylink_pcs_inband_caps() only checks if passed PCS is not NULL and directly dereference ops from the phylink_pcs struct.

Use the IS_ERR_OR_NULL macro to address both case where the returned PCS can be NULL or an error pointer and prevent a kernel panic.

Metrics

No CVSS score has been published yet.

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= df874f9e52c340cc6f0a0014a97b778f67d46849, < b6b533f83461c3730875cf3ed5ff6362dcb67be9; >= df874f9e52c340cc6f0a0014a97b778f67d46849, < fb4d77553841ae85bed9b2cf03351c401e871d85; >= df874f9e52c340cc6f0a0014a97b778f67d46849, < f2849b1fd059ec9b3281b771e6ac5aad9feee851
LinuxLinux6.14

References

Timeline

Published
Sep 11, 2026
Last modified
Oct 19, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-809947.8In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix flow mask use-after-free on flow deletion The coCVE-2026-809957.8In the Linux kernel, the following vulnerability has been resolved: net: mctp: hold a reference to the route device in mctp_route_lookup() CVE-2026-80996In the Linux kernel, the following vulnerability has been resolved: net: l2tp: do not propagate multicast notification errors The tunnel cCVE-2026-809977.5In the Linux kernel, the following vulnerability has been resolved: net: ipa: fix stalled modem TX queue after runtime resume ipa_start_xmCVE-2026-809987.5In the Linux kernel, the following vulnerability has been resolved: net: bnxt: ring the doorbell when SW USO exits early When a burst of pCVE-2026-80999In the Linux kernel, the following vulnerability has been resolved: net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIO rtl83xxCVE-2026-81008.6Impact A security issue has been identified in Chef 360 that could allow unauthorized access to protected API endpoints under specific condCVE-2026-810007.8In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom tun_get_user() uses tun->align both aCVE-2026-810017.8In the Linux kernel, the following vulnerability has been resolved: slip: fix use-after-free in sl_sync() slip_devs[] stores bare net_deviCVE-2026-810029.8In the Linux kernel, the following vulnerability has been resolved: xdp: fix zero-copy frame layout xdp_convert_zc_to_xdp_frame() clones aCVE-2026-810038.1In the Linux kernel, the following vulnerability has been resolved: net/iucv: filter frames in afiucv_hs_rcv() by ingress device afiucv_hsCVE-2026-810048.4In the Linux kernel, the following vulnerability has been resolved: ipmi:msghandler: Cancel work cleanly on an error If an error occurs du
CVE-2026-80993: Unscored | Vulnix