Riskcovery

CVE-2026-53232

net: phy: clean the sfp upstream if phy probing fails

State
Published
Severity
8.8 High
Published
Jun 25, 2026
Updated
Oct 30, 2026
Reserved
Jun 9, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

net: phy: clean the sfp upstream if phy probing fails

Sashiko reported that we don't call sfp_bus_del_upstream() in the probe failure path, so let's add it, otherwise the sfp-bus is left with a dangling 'upstream' field, that may be used later on during SFP events.

This issue existed before the generic phylib sfp support, back when drivers were calling phy_sfp_probe themselves.

Scores

CVSSScoreVectorSource
3.18.8 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

Affected Products

ProductVersions
LinuxLinux
  • 298e54fa810e027f1b0800d789eb862592721f08 to before 18c7c311323b19a353c3042180982e0ce5fa7e5fAffected
  • 298e54fa810e027f1b0800d789eb862592721f08 to before 12fb84dc4dc8eb47ebe2b27f7de6255a4a205e1bAffected
  • 298e54fa810e027f1b0800d789eb862592721f08 to before 9326b654f90a09eadeb796c82801a5609d57f0c8Affected
  • 298e54fa810e027f1b0800d789eb862592721f08 to before 3a254779c169954fe23328a1db51f67be374f913Affected
  • 298e54fa810e027f1b0800d789eb862592721f08 to before 0b27701ce93161d7bbf4b25fa20ca59963b0e20cAffected
  • 298e54fa810e027f1b0800d789eb862592721f08 to before 48774e87bbaa0056819d4b52301e4692e50e3252Affected
LinuxLinux
  • 5.5Affected
  • before 5.5Not affected
  • 6.1.191 through 6.1.*Not affected
  • 6.6.143 through 6.6.*Not affected
  • 6.12.94 through 6.12.*Not affected
  • 6.18.36 through 6.18.*Not affected
  • 7.0.13 through 7.0.*Not affected
  • 7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.