CVE-2026-98563
Received Received - Intake

Use-After-Free in Linux Kernel phylink Subsystem

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: phylink: record the PHY only once bringup cannot fail phylink_bringup_phy() stores the PHY in pl->phydev before its last fallible step: on a MAC whose phylink ops implement LPI, phy_eee_rx_clock_stop() can fail with a real MDIO error. The callers unwind with phy_detach(), which knows nothing about pl->phydev, so a pointer to a PHY that is no longer attached outlives the failed connect. What that costs depends on how the caller got here. phylink_connect_phy() goes through phylink_attach_phy(), which refuses to attach while pl->phydev is set, turning a transient MDIO error into a permanent -EBUSY. The SFP path is worse than that: sfp_sm_probe_phy() answers the failure with phy_device_remove() and phy_device_free(), and it assigns sfp->mod_phy only past that error return, so nothing clears pl->phydev and it is left pointing at a freed phy_device that phylink_resolve() and the ethtool helpers go on reading. phylink_fwnode_phy_connect() has no such check, so a later connect overwrites the stale pointer and hides the problem. A disconnect does not: phylink_disconnect_phy() hands that pointer to phy_disconnect(), and the second phy_detach() on the same PHY drops references the first one already released. Found while making a DSA port survive a PHY whose driver arrives after the switch probes: keeping the port across a failed connect and retrying is what makes this window reachable. Publish the pointer after the last call that can fail instead of unwinding it afterwards. Nothing between the two points reads pl->phydev, and the registration that follows cannot fail: phy_request_interrupt() falls back to polling on its own. The PHY-side state keeps the order it had, so no MDIO operation moves relative to another.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98563
EUVD
EUVD-2026-103608

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
Linux Linux 03abf2a7c65451e663b078b0ed1bfa648cd9380f
Linux Linux 03abf2a7c65451e663b078b0ed1bfa648cd9380f
Linux Linux 03abf2a7c65451e663b078b0ed1bfa648cd9380f
Linux Linux 6.14

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a race condition in the phylink subsystem where a PHY device pointer is stored before a critical operation that may fail. If the operation fails, cleanup code may not properly clear the pointer, leaving it pointing to freed memory. This can lead to use-after-free issues or other undefined behavior when the pointer is later accessed.

Detection Guidance

This vulnerability is specific to the Linux kernel's phylink subsystem and may not have direct detection commands. Monitor kernel logs for PHY-related errors or failures during network interface initialization. Check for repeated MDIO errors or PHY attach/detach issues in system logs.

Impact Analysis

This vulnerability could cause system instability, crashes, or security issues if exploited. It may lead to memory corruption, denial of service, or unauthorized access depending on how the affected system is used. Systems using network interfaces with PHY devices are particularly at risk.

Mitigation Strategies

Update the Linux kernel to a patched version that resolves this issue. If immediate patching is not possible, avoid scenarios where PHY drivers load after switch probes or where PHY connections are retried after failures.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98563. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart