CVE-2026-98563
In the Linux kernel, the following vulnerability has been resolved:
net: phylink: record the PHY only once bringup cannot fail
phylink_bringup_phy() stores the PHY in pl->phydev before its last fallible step: on a MAC whose phylink ops implement LPI, phy_eee_rx_clock_stop() can fail with a real MDIO error. The callers unwind with phy_detach(), which knows nothing about pl->phydev, so a pointer to a PHY that is no longer attached outlives the failed connect.
What that costs depends on how the caller got here. phylink_connect_phy() goes through phylink_attach_phy(), which refuses to attach while pl->phydev is set, turning a transient MDIO error into a permanent -EBUSY.
Read full descriptionShow less
The SFP path is worse than that: sfp_sm_probe_phy() answers the failure with phy_device_remove() and phy_device_free(), and it assigns sfp->mod_phy only past that error return, so nothing clears pl->phydev and it is left pointing at a freed phy_device that phylink_resolve() and the ethtool helpers go on reading. phylink_fwnode_phy_connect() has no such check, so a later connect overwrites the stale pointer and hides the problem. A disconnect does not: phylink_disconnect_phy() hands that pointer to phy_disconnect(), and the second phy_detach() on the same PHY drops references the first one already released.
Found while making a DSA port survive a PHY whose driver arrives after the switch probes: keeping the port across a failed connect and retrying is what makes this window reachable.
Publish the pointer after the last call that can fail instead of unwinding it afterwards. Nothing between the two points reads pl->phydev, and the registration that follows cannot fail: phy_request_interrupt() falls back to polling on its own. The PHY-side state keeps the order it had, so no MDIO operation moves relative to another.
CVSS
NVD hasn't assigned a CVSS score to this CVE (common since the April 2026 policy change).
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days
- 0.20 %
- Percentile among all scored CVEs
- 9
- Score date
- 10/20/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (1)
⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.
References
Raw JSON (NVD)
Show
{
"id": "CVE-2026-98563",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "03abf2a7c65451e663b078b0ed1bfa648cd9380f",
"lessThan": "4e7a4af364c2048bafb213bf0ef4a89dcbe1bfd4",
"versionType": "git"
},
{
"status": "affected",
"version": "03abf2a7c65451e663b078b0ed1bfa648cd9380f",
"lessThan": "671a68654a9d319d7f0d53a6321db3d9b391bdef",
"versionType": "git"
},
{
"status": "affected",
"version": "03abf2a7c65451e663b078b0ed1bfa648cd9380f",
"lessThan": "a940003f44e7e441c228151dd212642152700ec8",
"versionType": "git"
}
],
"programFiles": [
"drivers/net/phy/phylink.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.14"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.14",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/net/phy/phylink.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-10-18T16:17:08.443",
"references": [
{
"url": "https://git.kernel.org/stable/c/4e7a4af364c2048bafb213bf0ef4a89dcbe1bfd4",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/671a68654a9d319d7f0d53a6321db3d9b391bdef",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a940003f44e7e441c228151dd212642152700ec8",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: phylink: record the PHY only once bringup cannot fail\n\nphylink_bringup_phy() stores the PHY in pl->phydev before its last\nfallible step: on a MAC whose phylink ops implement LPI,\nphy_eee_rx_clock_stop() can fail with a real MDIO error. The callers\nunwind with phy_detach(), which knows nothing about pl->phydev, so a\npointer to a PHY that is no longer attached outlives the failed\nconnect.\n\nWhat that costs depends on how the caller got here.\nphylink_connect_phy() goes through phylink_attach_phy(), which refuses\nto attach while pl->phydev is set, turning a transient MDIO error into\na permanent -EBUSY. The SFP path is worse than that: sfp_sm_probe_phy()\nanswers the failure with phy_device_remove() and phy_device_free(), and\nit assigns sfp->mod_phy only past that error return, so nothing clears\npl->phydev and it is left pointing at a freed phy_device that\nphylink_resolve() and the ethtool helpers go on reading.\nphylink_fwnode_phy_connect() has no such check, so a later connect\noverwrites the stale pointer and hides the problem. A disconnect does\nnot: phylink_disconnect_phy() hands that pointer to phy_disconnect(),\nand the second phy_detach() on the same PHY drops references the first\none already released.\n\nFound while making a DSA port survive a PHY whose driver arrives after\nthe switch probes: keeping the port across a failed connect and\nretrying is what makes this window reachable.\n\nPublish the pointer after the last call that can fail instead of\nunwinding it afterwards. Nothing between the two points reads\npl->phydev, and the registration that follows cannot fail:\nphy_request_interrupt() falls back to polling on its own. The PHY-side\nstate keeps the order it had, so no MDIO operation moves relative to\nanother."
}
],
"lastModified": "2026-10-19T10:19:12.930",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}