CVE-2026-98594
Received Received - Intake

Memory Leak in Linux Kernel tg3 Driver

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: tg3: clean up PHYLIB resources on probe failure tg3_get_invariants() can register an MDIO bus and connect a PHY for USE_PHYLIB devices. If tg3_init_one() later fails, its common error path releases the mappings and netdev without undoing those PHYLIB resources. Disconnect the PHY and unregister the MDIO bus before the remaining teardown. Guard PHY cleanup with USE_PHYLIB to match tg3_phy_init(), and call tg3_mdio_fini() unconditionally to match tg3_mdio_init(). The existing IS_CONNECTED and MDIOBUS_INITED flags make both helpers safe when initialization only completed partially. This issue was identified during our ongoing static-analysis research while reviewing kernel code.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98594
EUVD
EUVD-2026-103639

Affected Vendors & Products

Showing 9 associated CPEs
Vendor Product Version / Range
Linux Linux 158d7abdae85e9ac43d99780c372d79c119f7626
Linux Linux 158d7abdae85e9ac43d99780c372d79c119f7626
Linux Linux 158d7abdae85e9ac43d99780c372d79c119f7626
Linux Linux 158d7abdae85e9ac43d99780c372d79c119f7626
Linux Linux 158d7abdae85e9ac43d99780c372d79c119f7626
Linux Linux 158d7abdae85e9ac43d99780c372d79c119f7626
Linux Linux 158d7abdae85e9ac43d99780c372d79c119f7626
Linux Linux 158d7abdae85e9ac43d99780c372d79c119f7626
Linux Linux 2.6.27

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper cleanup of PHYLIB resources during probe failure in the tg3 network driver. When tg3_init_one() fails, it does not undo PHYLIB resources like MDIO bus registration and PHY connections that were set up earlier by tg3_get_invariants(). This can lead to resource leaks.

Detection Guidance

This vulnerability is specific to the Linux kernel's tg3 driver and involves improper cleanup of PHYLIB resources during probe failure. Detection requires checking kernel logs for tg3 driver errors or examining the kernel version for unpatched releases.

Impact Analysis

This vulnerability may cause resource leaks in the Linux kernel's tg3 network driver, potentially leading to system instability or unexpected behavior if the driver fails during initialization. It does not directly expose a security risk but could affect network functionality.

Mitigation Strategies

Update the Linux kernel to the latest patched version where this issue is resolved. If using a distribution kernel, apply vendor-provided updates immediately. For custom kernels, ensure the patch for tg3 driver resource cleanup is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98594. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart