CVE-2026-90287

What it actually does

Improper error handling in kernel PHY initialization allows clock and reset resources to leak when intermediate operations fail, leaving hardware state partially configured.

Why it matters to the business

Low-probability risk of gradual resource exhaustion or unreliable hardware bring-up on affected Linux systems; limited operational impact given the low EPSS score and absence from known exploited lists.

How an attack unfolds

An attacker with local access or the ability to induce device probe failures would trigger the flawed error paths to leak resources; repeated triggering could degrade system stability, though no public exploits or threat actor campaigns are associated with this issue.

How to fix it

Update to a Linux kernel containing the corrected error-handling logic in the affected PHY driver; apply the fix that ensures exact reversal of each successful stage on failure.

How to confirm the fix worked

Confirm the running kernel includes the upstream commit that revises the error paths to release only the clock on reset failure and to jump to the proper cleanup label on voltage update failure; retest device probe under injected error conditions.

Typical attack path

1. Obtain local execution or influence device initialization on a vulnerable kernel
2. Force an error condition during clock enable or reset deassert phases
3. Observe accumulated resource leaks across multiple initialization attempts
4. Leverage resulting instability for denial-of-service or to mask other activity

How to detect it

Inspect kernel logs and dmesg output for repeated PHY initialization failures without corresponding resource release messages; correlate with system uptime and resource usage metrics on embedded or server platforms using the affected driver.

What your security team should do

• Prioritize kernel updates on systems using the Sunplus PHY driver during the next maintenance window
• Monitor EPSS and KEV status for any future increase in exploit activity
• Review device initialization logs for repeated probe failures that could indicate leak accumulation