---
id: CVE-2025-21921
title: 'net: ethtool: netlink: Allow NULL nlattrs when getting a phy_device'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net: ethtool: netlink: Allow NULL nlattrs when getting a phy_device

  ethnl_req_get_phydev() is used to lookup a phy_device, in the case an
  ethtool netlink command targe…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= c15e065b46dc4e19837275b826c1960d55564abd <
    639c70352958735addbba5ae7dd65985da96e061
  - >-
    Linux >= c15e065b46dc4e19837275b826c1960d55564abd <
    1f458fa42c29144cef280e05bc49fc21b873d897
  - >-
    Linux >= c15e065b46dc4e19837275b826c1960d55564abd <
    637399bf7e77797811adf340090b561a8f9d1213
  - Linux 6.12
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T20:37:00.578572Z'
published: '2025-04-01'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T20:41:48.069Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-21921'
references:
  - url: 'https://git.kernel.org/stable/c/639c70352958735addbba5ae7dd65985da96e061'
  - url: 'https://git.kernel.org/stable/c/1f458fa42c29144cef280e05bc49fc21b873d897'
  - url: 'https://git.kernel.org/stable/c/637399bf7e77797811adf340090b561a8f9d1213'
tags:
  - cve.org
epss: 0.00209
epssPercentile: 0.11161
ingestedAt: '2026-11-05T22:38:31.855Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net: ethtool: netlink: Allow NULL nlattrs when getting a phy_device

ethnl_req_get_phydev() is used to lookup a phy_device, in the case an
ethtool netlink command targets a specific phydev within a netdev's
topology.

It takes as a parameter a const struct nlattr *header that's used for
error handling :

       if (!phydev) {
               NL_SET_ERR_MSG_ATTR(extack, header,
                                   "no phy matching phyindex");
               return ERR_PTR(-ENODEV);
       }

In the notify path after a ->set operation however, there's no request
attributes available.

The typical callsite for the above function looks like:

	phydev = ethnl_req_get_phydev(req_base, tb[ETHTOOL_A_XXX_HEADER],
				      info->extack);

So, when tb is NULL (such as in the ethnl notify path), we have a nice
crash.

It turns out that there's only the PLCA command that is in that case, as
the other phydev-specific commands don't have a notification.

This commit fixes the crash by passing the cmd index and the nlattr
array separately, allowing NULL-checking it directly inside the helper.

## Affected

- `Linux >= c15e065b46dc4e19837275b826c1960d55564abd < 639c70352958735addbba5ae7dd65985da96e061`
- `Linux >= c15e065b46dc4e19837275b826c1960d55564abd < 1f458fa42c29144cef280e05bc49fc21b873d897`
- `Linux >= c15e065b46dc4e19837275b826c1960d55564abd < 637399bf7e77797811adf340090b561a8f9d1213`
- `Linux 6.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.