---
id: "CVE-2026-98594"
kind: "vulnerability"
aliases: ["CVE-2026-98594"]
title: "Linux tg3 driver leaks PHY and MDIO resources when probe fails"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["broadcom-nic", "infrastructure", "kernel", "linux", "servers", "tg3"]
not_affected_if: ["no-tg3-hardware", "tg3-not-loaded"]
published_at: "2026-10-18T16:17:12+00:00"
first_seen_at: "2026-10-23T21:57:16+00:00"
updated_at: "2026-10-25T05:21:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98594", "first_seen_at": "2026-10-23T21:57:16+00:00"}]
---

# Linux tg3 driver leaks PHY and MDIO resources when probe fails

The tg3 Ethernet driver in the Linux kernel does not release its PHYLIB MDIO bus and connected PHY when device probing fails partway. The sources describe a resource cleanup gap; they do not describe an attacker-triggered exploit.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `uname -r` and compare against the kernel version that carries the upstream tg3 fix, which the sources do not name
- Check whether the tg3 module is loaded with `lsmod | grep tg3` and whether the NIC uses it (`lspci -k | grep -A3 -i ethernet`)

## Fix

- Update the Linux kernel to a release that includes the upstream commit 'tg3: clean up PHYLIB resources on probe failure'; the sources do not give the version number
- Until updated, unknown whether a workaround exists beyond avoiding tg3 probe failures

## Timeline

- 2026-10-23T21:57:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98594

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

tg3: clean up PHYLIB resources on probe failure

tg3_get_invariants() can register an MDIO bus and connect a PHY for
USE_PHYLIB devices. If tg3_init_one() later fails, its common error path
releases the mappings and netdev without undoing those PHYLIB resources.

Disconnect the PHY and unregister the MDIO bus before the remaining
teardown. Guard PHY cleanup with USE_PHYLIB to match tg3_phy_init(), and
call tg3_mdio_fini() unconditionally to match tg3_mdio_init(). The existing
IS_CONNECTED and MDIOBUS_INITED flags make both helpers safe when
initialization only completed partially.

This issue was identified during our ongoing static-analysis research while
reviewing kernel code.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_