CVE-2026-98594
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: tg3: clean up PHYLIB resources on probe failure tg3_get_invariants() can register an MDIO bus and connect a PHY for USE_PHYLIB devices. If tg3_init_one() later fails, its common error path releases the mappings and netdev without undoing those PHYLIB resources. Disconnect the PHY and unregister the MDIO bus before the remaining teardown. Guard PHY cleanup with USE_PHYLIB to match tg3_phy_init(), and call tg3_mdio_fini() unconditionally to match tg3_mdio_init(). The existing IS_CONNECTED and MDIOBUS_INITED flags make both helpers safe when initialization only completed partially. This issue was identified during our ongoing static-analysis research while reviewing kernel code.
Severity
Not scored
CVSS score
Not available
Vulnerability status
Received
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-10-18 16:17:12.043000
Last modified
2026-10-19 10:19:20.620000
View original CVE JSON
{
"id": "CVE-2026-98594",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2026-10-18T16:17:12.043",
"lastModified": "2026-10-19T10:19:20.620",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntg3: clean up PHYLIB resources on probe failure\n\ntg3_get_invariants() can register an MDIO bus and connect a PHY for\nUSE_PHYLIB devices. If tg3_init_one() later fails, its common error path\nreleases the mappings and netdev without undoing those PHYLIB resources.\n\nDisconnect the PHY and unregister the MDIO bus before the remaining\nteardown. Guard PHY cleanup with USE_PHYLIB to match tg3_phy_init(), and\ncall tg3_mdio_fini() unconditionally to match tg3_mdio_init(). The existing\nIS_CONNECTED and MDIOBUS_INITED flags make both helpers safe when\ninitialization only completed partially.\n\nThis issue was identified during our ongoing static-analysis research while\nreviewing kernel code."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"drivers/net/ethernet/broadcom/tg3.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "158d7abdae85e9ac43d99780c372d79c119f7626",
"lessThan": "ce86d6929d03e6b0abcb781dfa50f9f0816bff78",
"versionType": "git",
"status": "affected"
},
{
"version": "158d7abdae85e9ac43d99780c372d79c119f7626",
"lessThan": "a449eedb3b1eb5b8b1f5ed116a1bfe85eaaf81df",
"versionType": "git",
"status": "affected"
},
{
"version": "158d7abdae85e9ac43d99780c372d79c119f7626",
"lessThan": "0844402326d4e48a28688f93ec6442e93bb442fa",
"versionType": "git",
"status": "affected"
},
{
"version": "158d7abdae85e9ac43d99780c372d79c119f7626",
"lessThan": "e766321288b507afb70d2bfef6ba443213329f79",
"versionType": "git",
"status": "affected"
},
{
"version": "158d7abdae85e9ac43d99780c372d79c119f7626",
"lessThan": "d2abb0013b933d59ee441185df0eca9e8c0b33eb",
"versionType": "git",
"status": "affected"
},
{
"version": "158d7abdae85e9ac43d99780c372d79c119f7626",
"lessThan": "6515c41503eef849abd2c7364f34e4bb25110f90",
"versionType": "git",
"status": "affected"
},
{
"version": "158d7abdae85e9ac43d99780c372d79c119f7626",
"lessThan": "b6c0c757c65893ad7bb17e8bcf33cdd8257d7b3d",
"versionType": "git",
"status": "affected"
},
{
"version": "158d7abdae85e9ac43d99780c372d79c119f7626",
"lessThan": "a92e1a412c53dc0d9ad639e7abf8b3fc70a5b6ad",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"drivers/net/ethernet/broadcom/tg3.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "2.6.27",
"status": "affected"
},
{
"version": "0",
"lessThan": "2.6.27",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.10.271",
"lessThanOrEqual": "5.10.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.222",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.189",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.158",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.112",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18.55",
"lessThanOrEqual": "6.18.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.2.9",
"lessThanOrEqual": "7.2.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.3",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/0844402326d4e48a28688f93ec6442e93bb442fa",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6515c41503eef849abd2c7364f34e4bb25110f90",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a449eedb3b1eb5b8b1f5ed116a1bfe85eaaf81df",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a92e1a412c53dc0d9ad639e7abf8b3fc70a5b6ad",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b6c0c757c65893ad7bb17e8bcf33cdd8257d7b3d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ce86d6929d03e6b0abcb781dfa50f9f0816bff78",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d2abb0013b933d59ee441185df0eca9e8c0b33eb",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e766321288b507afb70d2bfef6ba443213329f79",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}