CVE-2026-97973: net: macb: destroy the phylink instance on the probe error path
In the Linux kernel, the following vulnerability has been resolved:
net: macb: destroy the phylink instance on the probe error path
macbmiiinit() creates a phylink instance on both of its success paths, but the probe unwind frees the netdev without destroying it, so a failing macballoctieoff() or registernetdev() leaks the instance.
Destroy it at erroutunregistermdio, which is only reachable once macbmiiinit() has succeeded, so bp->phylink is valid there.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.158.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
On the probe error path, destroy the phylink instance at err_out_unregister_mdio after macb_mii_init() has succeeded, before freeing the netdev; this covers failures from macb_alloc_tieoff() or register_netdev().
Event History
Frequently Asked Questions
Under what conditions does the leak occur?
The leak occurs only when driver probing reaches macb_mii_init() successfully and then later fails in macb_alloc_tieoff() or register_netdev(). The error-unwind path frees the network device without destroying the previously created phylink instance.
Is this a runtime network attack issue?
The provided information describes a resource leak on the driver's probe error path, not a network-reachable runtime exploit. It is relevant when the macb driver is being initialized and a subsequent probe step fails.
How can I determine whether a system is affected?
Check whether the system uses the Linux kernel macb network driver and whether its probe path can fail after macb_mii_init() succeeds, specifically in macb_alloc_tieoff() or register_netdev(). The affected behavior is a leaked phylink instance during that failed initialization sequence.