CVE-2026-53232: net: phy: clean the sfp upstream if phy probing fails
In the Linux kernel, the following vulnerability has been resolved:
net: phy: clean the sfp upstream if phy probing fails
Sashiko reported that we don't call sfpbusdelupstream() in the probe failure path, so let's add it, otherwise the sfp-bus is left with a dangling 'upstream' field, that may be used later on during SFP events.
This issue existed before the generic phylib sfp support, back when drivers were calling physfpprobe themselves.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Ensure the probe failure path cleans the SFP upstream state by calling sfp_bus_del_upstream() when phy probing fails, so the sfp-bus is not left with a dangling 'upstream' field for later SFP events.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53232?
CVE-2026-53232 has a severity rating of 8.8, indicating it is classified as high risk.
How do I fix CVE-2026-53232?
To fix CVE-2026-53232, ensure you upgrade to the latest version of the Linux kernel that includes the patch addressing this vulnerability.
What types of systems are affected by CVE-2026-53232?
CVE-2026-53232 affects systems running vulnerable versions of the Linux kernel.
Can CVE-2026-53232 lead to data loss?
Yes, due to the potential mishandling of the sfp upstream, CVE-2026-53232 could lead to data integrity issues.
Is CVE-2026-53232 a remote attack vulnerability?
CVE-2026-53232 is a vulnerability that requires local access to exploit, as it involves kernel-level operations.