CVE-2026-98594: tg3: clean up PHYLIB resources on probe failure
In the Linux kernel, the following vulnerability has been resolved:
tg3: clean up PHYLIB resources on probe failure
tg3getinvariants() can register an MDIO bus and connect a PHY for USEPHYLIB devices. If tg3initone() later fails, its common error path releases the mappings and netdev without undoing those PHYLIB resources.
Disconnect the PHY and unregister the MDIO bus before the remaining teardown. Guard PHY cleanup with USEPHYLIB to match tg3phyinit(), and call tg3mdiofini() unconditionally to match tg3mdioinit(). The existing ISCONNECTED and MDIOBUSINITED flags make both helpers safe when initialization only completed partially.
This issue was identified during our ongoing static-analysis research while reviewing kernel code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
On tg3 probe-failure teardown, call tg3_mdio_fini() unconditionally to disconnect the PHY and unregister the MDIO bus before releasing mappings and the netdev.
- Compensating control
Guard tg3 PHY cleanup with USE_PHYLIB, and use the IS_CONNECTED and MDIOBUS_INITED flags so cleanup helpers safely handle partially completed initialization.
Event History
Frequently Asked Questions
When can this issue be triggered?
It occurs when a tg3 device using PHYLIB reaches tg3_get_invariants(), registers an MDIO bus and connects a PHY, and then tg3_init_one() fails later during probing.
What is the impact of the failed probe path?
The prior error path released mappings and the network device without disconnecting the PHY or unregistering the MDIO bus, leaving PHYLIB resources uncleared after probe failure.
What does the fix change?
The fix disconnects the PHY for USE_PHYLIB devices and calls tg3_mdio_fini() during teardown. Existing IS_CONNECTED and MDIOBUS_INITED flags make cleanup safe even when initialization was only partially completed.