{"id":"CVE-2026-98563","kind":"vulnerability","aliases":["CVE-2026-98563"],"related":[],"title":"Linux kernel: phylink stale PHY pointer causes failed-connect use-after-free","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: phylink: record the PHY only once bringup cannot fail\n\nphylink_bringup_phy() stores the PHY in pl->phydev before its last\nfallible step: on a MAC whose phylink ops implement LPI,\nphy_eee_rx_clock_stop() can fail with a real MDIO error. The callers\nunwind with phy_detach(), which knows nothing about pl->phydev, so a\npointer to a PHY that is no longer attached outlives the failed\nconnect.\n\nWhat that costs depends on how the caller got here.\nphylink_connect_phy() goes through phylink_attach_phy(), which refuses\nto attach while pl->phydev is set, turning a transient MDIO error into\na permanent -EBUSY. The SFP path is worse than that: sfp_sm_probe_phy()\nanswers the failure with phy_device_remove() and phy_device_free(), and\nit assigns sfp->mod_phy only past that error return, so nothing clears\npl->phydev and it is left pointing at a freed phy_device that\nphylink_resolve() and the ethtool helpers go on reading.\nphylink_fwnode_phy_connect() has no such check, so a later connect\noverwrites the stale pointer and hides the problem. A disconnect does\nnot: phylink_disconnect_phy() hands that pointer to phy_disconnect(),\nand the second phy_detach() on the same PHY drops references the first\none already released.\n\nFound while making a DSA port survive a PHY whose driver arrives after\nthe switch probes: keeping the port across a failed connect and\nretrying is what makes this window reachable.\n\nPublish the pointer after the last call that can fail instead of\nunwinding it afterwards. Nothing between the two points reads\npl->phydev, and the registration that follows cannot fail:\nphy_request_interrupt() falls back to polling on its own. The PHY-side\nstate keeps the order it had, so no MDIO operation moves relative to\nanother.","summary":"A failed PHY connect in the Linux kernel's phylink code leaves a pointer to a PHY that is no longer attached, and later code reads or releases it. The sources do not state what an attacker can gain beyond a crash or memory corruption.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dsa","linux-kernel","networking","package","phylink","sfp"],"not_affected_if":["no-phylink-hardware"],"how_to_check":"- unknown","fix":"- Upgrade to a Linux kernel release that includes the upstream commit resolving this phylink issue (fixed version unknown from sources)","status":"open","published_at":"2026-10-18T16:17:08+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:23:20+00:00","updated_at":"2026-10-25T05:23:20+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T05:23:20Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade to a Linux kernel release that includes the upstream commit resolving this phylink issue (fixed version unknown from sources)","reach":"local","title":"Linux kernel: phylink stale PHY pointer causes failed-connect use-after-free","impact":"medium","summary":"A failed PHY connect in the Linux kernel's phylink code leaves a pointer to a PHY that is no longer attached, and later code reads or releases it. The sources do not state what an attacker can gain beyond a crash or memory corruption.","category":"package","nicknames":[],"who_cares":["linux-kernel","networking","phylink","dsa","sfp"],"confidence":0.5,"needs_auth":"unknown","worst_case":"kernel memory corruption or crash from a stale PHY pointer","analyst_note":"Find the fixed kernel versions and the upstream commit for this phylink change at https://nvd.nist.gov/vuln/detail/CVE-2026-98563 and confirm the attacker-reachable impact.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-phylink-hardware"],"who_is_affected":"Systems running a Linux kernel with phylink-managed network ports where the MAC implements LPI (EEE) and a PHY connect can fail, such as SFP modules or DSA switch ports whose PHY driver loads late. Systems without these hardware paths are unlikely to be affected; the sources do not say more.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000657,"input_tokens":3872,"output_tokens":539,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-98563':17A,20A 'across':317C 'afterward':343C 'alreadi':296C 'anoth':386C 'answer':202C 'arriv':309C 'assign':215C 'attach':50B,150C,171C,176C 'attack':65B 'back':363C 'beyond':68B 'bringup':91C,95C 'call':335C 'caller':129C,162C 'cannot':92C,357C 'caus':7A 'check':256C 'clear':226C 'clock':119C 'code':39B,53B 'connect':10A,32B,154C,166C,252C,260C,320C 'corrupt':73B 'cost':157C 'crash':70B 'cve':15A,18A 'depend':158C 'detach':133C,286C 'devic':207C,211C,238C 'disconnect':270C,274C,281C 'driver':308C 'drop':291C 'dsa':21B,302C 'ebusi':190C 'eee':117C 'error':127C,186C,222C 'ethtool':244C 'fail':9A,30B,93C,122C,153C,319C,338C,358C 'failed-connect':8A 'failur':204C 'fall':362C 'fallibl':106C 'first':294C 'follow':79C,356C 'found':298C 'free':14A,212C 'freed':236C 'fwnode':250C 'gain':67B 'go':246C 'goe':168C 'got':163C 'hand':276C 'helper':245C 'hide':266C 'implement':114C 'instead':339C 'interrupt':361C 'keep':314C,374C 'kernel':2A,24B,36B,77C 'know':135C 'last':105C,334C 'later':52B,259C 'leav':40B 'left':232C 'linux':1A,23B,35B,76C 'linux-kernel':22B 'longer':49B,149C 'lpi':115C 'mac':110C 'make':300C,325C 'mdio':126C,185C,381C 'memori':72B 'mod':217C 'move':383C 'net':84C 'network':25B 'noth':136C,225C,344C 'one':295C 'op':113C 'oper':382C 'order':376C 'outliv':151C 'overwrit':261C 'packag':26B 'past':220C 'path':193C 'perman':189C 'phi':5A,31B,45B,88C,96C,99C,116C,132C,145C,167C,172C,201C,206C,210C,218C,237C,251C,275C,280C,285C,290C,306C,359C,371C 'phy-sid':370C 'phydev':102C,139C,179C,228C,351C 'phylink':3A,27B,38B,85C,94C,112C,165C,170C,240C,249C,273C 'pl':101C,138C,178C,227C,350C 'point':233C,348C 'pointer':6A,42B,142C,264C,278C,331C 'poll':365C 'port':303C,316C 'probe':200C,313C 'problem':268C 'publish':329C 'reachabl':328C 'read':54B,248C,349C 'real':125C 'record':86C 'refer':292C 'refus':174C 'registr':354C 'relat':384C 'releas':56B,297C 'remov':208C 'request':360C 'resolv':83C,241C 'retri':322C 'return':223C 'rx':118C 'second':284C 'set':181C 'sfp':28B,192C,198C,216C 'side':372C 'sm':199C 'sourc':59B 'stale':4A,263C 'state':62B,373C 'step':107C 'stop':120C 'store':97C 'surviv':304C 'switch':312C 'transient':184C 'turn':182C 'two':347C 'unwind':130C,341C 'use':12A 'use-after-fre':11A 'vulner':80C 'whose':111C,307C 'window':327C 'wors':195C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with phylink-managed network ports where the MAC implements LPI (EEE) and a PHY connect can fail, such as SFP modules or DSA switch ports whose PHY driver loads late. Systems without these hardware paths are unlikely to be affected; the sources do not say more.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:08+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98563","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98563","severity":null,"published_at":"2026-10-18T16:17:08+00:00","modified_at":"2026-10-19T10:19:12+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}