{"id":"CVE-2026-98594","kind":"vulnerability","aliases":["CVE-2026-98594"],"related":[],"title":"Linux tg3 driver leaks PHY and MDIO resources when probe fails","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntg3: clean up PHYLIB resources on probe failure\n\ntg3_get_invariants() can register an MDIO bus and connect a PHY for\nUSE_PHYLIB devices. If tg3_init_one() later fails, its common error path\nreleases the mappings and netdev without undoing those PHYLIB resources.\n\nDisconnect the PHY and unregister the MDIO bus before the remaining\nteardown. Guard PHY cleanup with USE_PHYLIB to match tg3_phy_init(), and\ncall tg3_mdio_fini() unconditionally to match tg3_mdio_init(). The existing\nIS_CONNECTED and MDIOBUS_INITED flags make both helpers safe when\ninitialization only completed partially.\n\nThis issue was identified during our ongoing static-analysis research while\nreviewing kernel code.","summary":"The tg3 Ethernet driver in the Linux kernel does not release its PHYLIB MDIO bus and connected PHY when device probing fails partway. The sources describe a resource cleanup gap; they do not describe an attacker-triggered exploit.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["broadcom-nic","infrastructure","kernel","linux","servers","tg3"],"not_affected_if":["no-tg3-hardware","tg3-not-loaded"],"how_to_check":"- Run `uname -r` and compare against the kernel version that carries the upstream tg3 fix, which the sources do not name\n- Check whether the tg3 module is loaded with `lsmod | grep tg3` and whether the NIC uses it (`lspci -k | grep -A3 -i ethernet`)","fix":"- Update the Linux kernel to a release that includes the upstream commit 'tg3: clean up PHYLIB resources on probe failure'; the sources do not give the version number\n- Until updated, unknown whether a workaround exists beyond avoiding tg3 probe failures","status":"open","published_at":"2026-10-18T16:17:12+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:21:41+00:00","updated_at":"2026-10-25T05:21:41+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-25T05:21:41Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit 'tg3: clean up PHYLIB resources on probe failure'; the sources do not give the version number\n- Until updated, unknown whether a workaround exists beyond avoiding tg3 probe failures","reach":"local","title":"Linux tg3 driver leaks PHY and MDIO resources when probe fails","impact":"low","summary":"The tg3 Ethernet driver in the Linux kernel does not release its PHYLIB MDIO bus and connected PHY when device probing fails partway. The sources describe a resource cleanup gap; they do not describe an attacker-triggered exploit.","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","broadcom-nic","tg3","servers"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown: resource leak on probe failure, impact not stated","analyst_note":"Find the upstream kernel commit and fixed stable versions from the NVD entry or kernel.org git log for 'tg3: clean up PHYLIB resources on probe failure', and confirm whether the leak has any security impact beyond resource exhaustion.","how_to_check":"- Run `uname -r` and compare against the kernel version that carries the upstream tg3 fix, which the sources do not name\n- Check whether the tg3 module is loaded with `lsmod | grep tg3` and whether the NIC uses it (`lspci -k | grep -A3 -i ethernet`)","needs_analyst":true,"not_affected_if":["no-tg3-hardware","tg3-not-loaded"],"who_is_affected":"Systems that load the tg3 driver for Broadcom NICs with PHYLIB support, where the driver initialization can fail after registering an MDIO bus. Systems without Broadcom tg3 hardware, or that do not use the tg3 module, are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000697,"input_tokens":3511,"output_tokens":692,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98594':14A,17A 'analysi':179C 'attack':62B 'attacker-trigg':61B 'broadcom':19B 'broadcom-n':18B 'bus':40B,90C,126C 'call':143C 'clean':76C 'cleanup':54B,133C 'code':184C 'common':106C 'complet':168C 'connect':42B,92C,156C 'cve':12A,15A 'describ':51B,59B 'devic':45B,98C 'disconnect':119C 'driver':3A,29B 'error':107C 'ethernet':28B 'exist':154C 'exploit':64B 'fail':11A,47B,104C 'failur':82C 'fini':146C 'flag':160C 'follow':70C 'gap':55B 'get':84C 'guard':131C 'helper':163C 'identifi':173C 'infrastructur':21B 'init':101C,141C,152C,159C 'initi':166C 'invari':85C 'issu':171C 'kernel':22B,33B,68C,183C 'later':103C 'leak':4A 'linux':1A,23B,32B,67C 'make':161C 'map':111C 'match':138C,149C 'mdio':7A,39B,89C,125C,145C,151C 'mdiobus':158C 'netdev':113C 'nic':20B 'one':102C 'ongo':176C 'partial':169C 'partway':48B 'path':108C 'phi':5A,43B,94C,121C,132C,140C 'phylib':38B,78C,97C,117C,136C 'probe':10A,46B,81C 'regist':87C 'releas':36B,109C 'remain':129C 'research':180C 'resolv':74C 'resourc':8A,53B,79C,118C 'review':182C 'safe':164C 'server':24B 'sourc':50B 'static':178C 'static-analysi':177C 'teardown':130C 'tg3':2A,25B,27B,75C,83C,100C,139C,144C,150C 'trigger':63B 'uncondit':147C 'undo':115C 'unregist':123C 'use':96C,135C 'vulner':71C 'without':114C","nicknames":[],"mitigations":[],"who_affected":"Systems that load the tg3 driver for Broadcom NICs with PHYLIB support, where the driver initialization can fail after registering an MDIO bus. Systems without Broadcom tg3 hardware, or that do not use the tg3 module, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:12+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98594","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98594","severity":null,"published_at":"2026-10-18T16:17:12+00:00","modified_at":"2026-10-19T10:19:20+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}