CVE-2026-97973

Received Received - Intake

Linux Kernel Phylink Instance Leak in MACB Driver

Publication date: 2026-09-25

Last updated on: 2026-10-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net: macb: destroy the phylink instance on the probe error path macb_mii_init() creates a phylink instance on both of its success paths, but the probe unwind frees the netdev without destroying it, so a failing macb_alloc_tieoff() or register_netdev() leaks the instance. Destroy it at err_out_unregister_mdio, which is only reachable once macb_mii_init() has succeeded, so bp->phylink is valid there.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-03

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-97973

EUVD

EUVD-2026-86827

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a memory leak during network interface probe failure. When initializing the MACB network driver, a phylink instance is created but not properly destroyed if subsequent steps fail. This leaves the instance allocated, wasting system resources.

Detection Guidance

This vulnerability is specific to the Linux kernel's macb network driver and involves a phylink instance leak during probe errors. Detection requires checking kernel logs for macb driver errors or probe failures. No direct commands are provided in the context to detect this issue.

Impact Analysis

The impact is limited to systems using the MACB network driver. If probe fails, it may cause resource exhaustion over time due to leaked phylink instances, potentially leading to network interface instability or system slowdowns.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a memory leak in the Linux kernel's macb network driver, which could lead to resource exhaustion but does not involve data breaches or unauthorized access to sensitive information.

Mitigation Strategies

Update the Linux kernel to a patched version where this vulnerability is resolved. Check your distribution's security advisories for kernel updates addressing CVE-2026-97973.

Hi! I’m here to help you understand CVE-2026-97973. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70