CVE-2026-97972: net: macb: put the "mdio" child node reference on success
In the Linux kernel, the following vulnerability has been resolved:
net: macb: put the "mdio" child node reference on success
macbmiiinit() holds the reference returned by ofgetchildbyname() for macbmdiobusregister() and drops it only on the error paths, so every successful probe leaks a node reference. On a CM5, overlay removal after four bind cycles reports
OF: ERROR: memory leak, expected refcount 1 instead of 5
Drop the reference after registration, where mdiobusregister() has already taken its own for the lifetime of the bus.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update macb_mdiobus_register() or the successful macb_mii_init() path to put the "mdio" child node reference after registration, while retaining the reference for the lifetime of the bus.
Linux kernel net: macb MDIO child node reference handling = drop the "mdio" child node reference after successful registration
Event History
Frequently Asked Questions
When does the reference leak occur?
The leak occurs on each successful probe of the macb driver, because the MDIO child-node reference is released on error paths but not after successful registration.
What operational symptom can indicate that a system is affected?
Repeated bind cycles followed by device-tree overlay removal can trigger an OF memory-leak report. The reported condition is an unexpected node reference count greater than the expected count of 1; the described CM5 test reached 5 after four bind cycles.
Is this limited to failed driver initialization?
No. Failed initialization already drops the child-node reference on error paths. The affected path is successful registration, after which the reference should be released because the MDIO bus registration has taken its own lifetime reference.