CVE-2026-80993

A flaw was found in the Linux kernel's net: phylink component. The phylink_inband_caps() function does not correctly validate the return value from mac_select_pcs, which can return an error pointer instead of a valid Physical Coding Sublayer (PCS) object. This oversight can lead to dereferencing an invalid pointer, causing a kernel panic. A kernel panic results in a system crash, leading to a Denial of Service (DoS).

A low impact flaw was found in the Linux kernel's networking phylink subsystem. In phylink_inband_caps(), the Physical Coding Sublayer (PCS) pointer returned by the mac_select_pcs callback was only checked against NULL, even though mac_select_pcs can also return an error pointer. phylink_pcs_inband_caps() subsequently dereferences such an unvalidated pointer, which can cause a kernel panic that crashes the system and results in a local denial of service. Exploiting this flaw requires local access to a system and the ability to exercise the affected phylink/network device configuration code path; there is no impact on confidentiality or integrity (Red Hat CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Within Red Hat's product portfolio, the flaw affects the kernel and kernel-rt packages in current Red Hat Enterprise Linux 9 and 10 update streams and the RHEL CoreOS kernel shipped in recent OpenShift Container Platform 4 releases. Earlier Red Hat Enterprise Linux and OpenShift streams are not affected because the vulnerable code is not present in the kernel versions they ship. For the affected products the fix is deferred given the low security impact of this flaw; the residual risk is that a local user able to trigger the affected code path can cause a kernel panic and deny service to the system.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.