CVE-2026-97973

net: macb: destroy the phylink instance on the probe error path

N/A
Published: September 25, 2026 at 10:23 AM UTC
Updated: October 19, 2026 at 10:17 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
N/A
Exploit prediction
EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: net: macb: destroy the phylink instance on the probe error path macb_mii_init() creates a phylink instance on both of its success paths, but the probe unwind frees the netdev without destroying it, so a failing macb_alloc_tieoff() or register_netdev() leaks the instance. Destroy it at err_out_unregister_mdio, which is only reachable once macb_mii_init() has succeeded, so bp->phylink is valid there.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

5.57897b071ac3b45a5788d084fc7f8a8ee9e5f07f0
Vendor states this is fixed in 0112aa02c7847314be599d68783d50c7e228a694 (fixed)
Vendor states this is fixed in 23b6a44ffea1c54a4232aa86ee470b21422a8cc5 (fixed)
Vendor states this is fixed in 7d059f390750152b9bd69df934198651b94fc26d (fixed)
Vendor states this is fixed in 8558e3195664113c14a4d8fcf221b3caff41fed1 (fixed)
Vendor states this is fixed in c1de1e7b51ab2531f564b39b51998c3d71caccd7 (fixed)
Vendor states this is fixed in e92a45b872b035c79acde8dd0da096a72b61ff2f (fixed)
Vendor states this is fixed in 5.5 (unaffected)
Vendor states this is fixed in 6.1.189 (unaffected)
Vendor states this is fixed in 6.12.111 (unaffected)
Vendor states this is fixed in 6.18.53 (unaffected)
Vendor states this is fixed in 6.6.158 (unaffected)
Vendor states this is fixed in 7.2.7 (unaffected)
Vendor states this is fixed in 7.3 (unaffected)
Vendor states this is fixed in 7.3-rc3 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

Quick Info

StatusRECEIVED

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card