From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0F0CE4D37A7 for ; Sun, 18 Oct 2026 15:29:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792337361; cv=none; b=Mtjlt8/DKQLb7Maqum8kvS1tDxxGsr08AT2zMhDFlCvNhWLfYONS+Dmo2pHwKIuSNJ/tXReha2Q3O65rBanUXh/c3+Qk5SK/j2NJag4H52JAW77ifUTQvwzwpZkrP7DZk/cyS5cZY5qr6e4+W5BIgRKB54xdzxV/OuU4mJ+G75I= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792337361; c=relaxed/simple; bh=sIzL8U/1qQmmR8qTnvbH3TMyk56ODobfpzUcLwO2d6c=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=EBm/sA2lP3n/KyXX5CXKa/atySl1j8lp7+sEpIIzXr/OGC207Bv5cQ4Np6kqmJaskMI0/1jCKl4ZImvwfi00F5viNR6jZBV9KxTeUJc9tLqs8kJuOhA0x+9Ma0akHuTm7e7XTRk6HEY4nXnyWweeLmX0URsYQyZQ8dLxdPuU9QE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=kxL/NBwl; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="kxL/NBwl" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 20E691F000C4; Sun, 18 Oct 2026 15:29:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1792337359; bh=h5sFskaG0dhU1lWVdsdFNuv7YkIY6hduKsfB0qOZzCQ=; h=From:To:Cc:Subject:Date:Reply-To; b=kxL/NBwlVG2Qp1x8RWD1mgjYcNLLsHvEBEFkD5Ue3606NmnHpbkLysNYQguj5teED L6alX3+U26UDCK4tRoJkm2xGuFIg9E4SUcyx+yEaKhr/ey3hbkUaJ06Yz7V2qt2dpz lenbY+Ole0eGRh9Ol3+bjrTTnw6RXW+9g6MKKRXI= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-98563: net: phylink: record the PHY only once bringup cannot fail Date: Sun, 18 Oct 2026 17:17:07 +0200 Message-ID: <2026101830-CVE-2026-98563-7fd4@gregkh> X-Mailer: git-send-email 2.56.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3709; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=xzF8n3SavKAUKQJf74H028RVTr4gerLoji1iPyOreDI=; b=owGbwMvMwCRo6H6F97bub03G02pJDFlXHk16F7lYjYXNfENvVOYXqYO79+2f1HZ4hqxuWfTci pVLXVw2dsSyMAgyMciKKbJ82cZzdH/FIUUvQ9vTMHNYmUCGMHBxCsBEpu5gWDC5S9/3uLIne9Qk NZO3KzoXrmhI9mBYsLQiX+uvbHqsTbh+j/jakBTmF9n3AA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: net: phylink: record the PHY only once bringup cannot fail phylink_bringup_phy() stores the PHY in pl->phydev before its last fallible step: on a MAC whose phylink ops implement LPI, phy_eee_rx_clock_stop() can fail with a real MDIO error. The callers unwind with phy_detach(), which knows nothing about pl->phydev, so a pointer to a PHY that is no longer attached outlives the failed connect. What that costs depends on how the caller got here. phylink_connect_phy() goes through phylink_attach_phy(), which refuses to attach while pl->phydev is set, turning a transient MDIO error into a permanent -EBUSY. The SFP path is worse than that: sfp_sm_probe_phy() answers the failure with phy_device_remove() and phy_device_free(), and it assigns sfp->mod_phy only past that error return, so nothing clears pl->phydev and it is left pointing at a freed phy_device that phylink_resolve() and the ethtool helpers go on reading. phylink_fwnode_phy_connect() has no such check, so a later connect overwrites the stale pointer and hides the problem. A disconnect does not: phylink_disconnect_phy() hands that pointer to phy_disconnect(), and the second phy_detach() on the same PHY drops references the first one already released. Found while making a DSA port survive a PHY whose driver arrives after the switch probes: keeping the port across a failed connect and retrying is what makes this window reachable. Publish the pointer after the last call that can fail instead of unwinding it afterwards. Nothing between the two points reads pl->phydev, and the registration that follows cannot fail: phy_request_interrupt() falls back to polling on its own. The PHY-side state keeps the order it had, so no MDIO operation moves relative to another. The Linux kernel CVE team has assigned CVE-2026-98563 to this issue. Affected and fixed versions =========================== Issue introduced in 6.14 with commit 03abf2a7c65451e663b078b0ed1bfa648cd9380f and fixed in 6.18.55 with commit 4e7a4af364c2048bafb213bf0ef4a89dcbe1bfd4 Issue introduced in 6.14 with commit 03abf2a7c65451e663b078b0ed1bfa648cd9380f and fixed in 7.2.9 with commit 671a68654a9d319d7f0d53a6321db3d9b391bdef Issue introduced in 6.14 with commit 03abf2a7c65451e663b078b0ed1bfa648cd9380f and fixed in 7.3-rc5 with commit a940003f44e7e441c228151dd212642152700ec8 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-98563 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/net/phy/phylink.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/4e7a4af364c2048bafb213bf0ef4a89dcbe1bfd4 https://git.kernel.org/stable/c/671a68654a9d319d7f0d53a6321db3d9b391bdef https://git.kernel.org/stable/c/a940003f44e7e441c228151dd212642152700ec8