CVE-2026-97973: net: macb: destroy the phylink instance on the probe error path
In the Linux kernel, the following vulnerability has been resolved:
net: macb: destroy the phylink instance on the probe error path
macbmiiinit() creates a phylink instance on both of its success paths, but the probe unwind frees the netdev without destroying it, so a failing macballoctieoff() or registernetdev() leaks the instance.
Destroy it at erroutunregistermdio, which is only reachable once macbmiiinit() has succeeded, so bp->phylink is valid there.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In the Linux kernel net: macb probe error path, destroy the phylink instance at err_out_unregister_mdio before freeing the netdev; macb_mii_init() has succeeded there, so bp->phylink is valid.
Event History
Frequently Asked Questions
Under what conditions does the leak occur?
The leak occurs only when driver probing reaches macb_mii_init() successfully and then later fails in macb_alloc_tieoff() or register_netdev(). The error-unwind path frees the network device without destroying the previously created phylink instance.
Is this a runtime network attack issue?
The provided information describes a resource leak on the driver's probe error path, not a network-reachable runtime exploit. It is relevant when the macb driver is being initialized and a subsequent probe step fails.
How can I determine whether a system is affected?
Check whether the system uses the Linux kernel macb network driver and whether its probe path can fail after macb_mii_init() succeeds, specifically in macb_alloc_tieoff() or register_netdev(). The affected behavior is a leaked phylink instance during that failed initialization sequence.