What’s Vulnerable › Vulnerabilities

CVE-2026-53232: net: phy: clean the sfp upstream if phy probing fails

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-25 · updated 2026-10-30
• Weakness: CWE-416

Description

In the Linux kernel, the following vulnerability has been resolved: net: phy: clean the sfp upstream if phy probing fails Sashiko reported that we don't call sfp_bus_del_upstream() in the probe failure path, so let's add it, otherwise the sfp-bus is left with a dangling 'upstream' field, that may be used later on during SFP events. This issue existed before the generic phylib sfp support, back when drivers were calling phy_sfp_probe themselves.

Affected products

• Linux kernel: from 5.5 before 7.1; 7.1-rc1, 7.1-rc2, 7.1-rc3, 7.1-rc4, 7.1-rc5, 7.1-rc6 (+1) — fixed in 7.1
• Linux: 5.5 — fixed in 7.1

How to fix

Upgrade to a fixed version: Linux kernel 7.1; Linux 7.1. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/0b27701ce93161d7bbf4b25fa20ca59963b0e20c
• https://git.kernel.org/stable/c/12fb84dc4dc8eb47ebe2b27f7de6255a4a205e1b
• https://git.kernel.org/stable/c/18c7c311323b19a353c3042180982e0ce5fa7e5f
• https://git.kernel.org/stable/c/3a254779c169954fe23328a1db51f67be374f913
• https://git.kernel.org/stable/c/48774e87bbaa0056819d4b52301e4692e50e3252
• https://git.kernel.org/stable/c/9326b654f90a09eadeb796c82801a5609d57f0c8

Get alerted when CVE-2026-53232 or the next vulnerability affects your stack