{"id":"CVE-2025-21921","title":"net: ethtool: netlink: Allow NULL nlattrs when getting a phy_device","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethtool: netlink: Allow NULL nlattrs when getting a phy_device\n\nethnl_req_get_phydev() is used to lookup a phy_device, in the case an\nethtool netlink command targe…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= c15e065b46dc4e19837275b826c1960d55564abd < 639c70352958735addbba5ae7dd65985da96e061","Linux >= c15e065b46dc4e19837275b826c1960d55564abd < 1f458fa42c29144cef280e05bc49fc21b873d897","Linux >= c15e065b46dc4e19837275b826c1960d55564abd < 637399bf7e77797811adf340090b561a8f9d1213","Linux 6.12"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T20:37:00.578572Z"},"published":"2025-04-01","updated":"2026-11-05","sourceUpdated":"2026-11-05T20:41:48.069Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-21921","references":[{"url":"https://git.kernel.org/stable/c/639c70352958735addbba5ae7dd65985da96e061"},{"url":"https://git.kernel.org/stable/c/1f458fa42c29144cef280e05bc49fc21b873d897"},{"url":"https://git.kernel.org/stable/c/637399bf7e77797811adf340090b561a8f9d1213"}],"tags":["cve.org"],"epss":0.00209,"epssPercentile":0.11161,"ingestedAt":"2026-11-05T22:38:31.855Z","slug":"CVE-2025-21921","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethtool: netlink: Allow NULL nlattrs when getting a phy_device\n\nethnl_req_get_phydev() is used to lookup a phy_device, in the case an\nethtool netlink command targets a specific phydev within a netdev's\ntopology.\n\nIt takes as a parameter a const struct nlattr *header that's used for\nerror handling :\n\n       if (!phydev) {\n               NL_SET_ERR_MSG_ATTR(extack, header,\n                                   \"no phy matching phyindex\");\n               return ERR_PTR(-ENODEV);\n       }\n\nIn the notify path after a ->set operation however, there's no request\nattributes available.\n\nThe typical callsite for the above function looks like:\n\n\tphydev = ethnl_req_get_phydev(req_base, tb[ETHTOOL_A_XXX_HEADER],\n\t\t\t\t      info->extack);\n\nSo, when tb is NULL (such as in the ethnl notify path), we have a nice\ncrash.\n\nIt turns out that there's only the PLCA command that is in that case, as\nthe other phydev-specific commands don't have a notification.\n\nThis commit fixes the crash by passing the cmd index and the nlattr\narray separately, allowing NULL-checking it directly inside the helper.\n\n## Affected\n\n- `Linux >= c15e065b46dc4e19837275b826c1960d55564abd < 639c70352958735addbba5ae7dd65985da96e061`\n- `Linux >= c15e065b46dc4e19837275b826c1960d55564abd < 1f458fa42c29144cef280e05bc49fc21b873d897`\n- `Linux >= c15e065b46dc4e19837275b826c1960d55564abd < 637399bf7e77797811adf340090b561a8f9d1213`\n- `Linux 6.12`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}