CVE-2026-53232
Received Received - Intake
Linux Kernel SFP Bus Memory Leak in PHY Probe Failure

Publication date: 2026-06-25

Last updated on: 2026-06-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: phy: clean the sfp upstream if phy probing fails Sashiko reported that we don't call sfp_bus_del_upstream() in the probe failure path, so let's add it, otherwise the sfp-bus is left with a dangling 'upstream' field, that may be used later on during SFP events. This issue existed before the generic phylib sfp support, back when drivers were calling phy_sfp_probe themselves.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-25
Last Modified
2026-06-25
Generated
2026-06-25
AI Q&A
2026-06-25
EPSS Evaluated
N/A
NVD
CVE-2026-53232
EUVD
EUVD-2026-39323
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
linux linux_kernel *
linux_kernel linux_kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel relates to the handling of the Small Form-factor Pluggable (SFP) bus during the physical layer (phy) probing process. Specifically, when phy probing fails, the function sfp_bus_del_upstream() is not called, leaving the sfp-bus with a dangling 'upstream' field. This dangling reference can later be used during SFP events, potentially causing unexpected behavior or errors.

Impact Analysis

The impact of this vulnerability is that the SFP bus may retain invalid or dangling references after a failed phy probe. This can lead to instability or incorrect behavior during subsequent SFP events, which might affect network device functionality or reliability.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53232. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart