Cloudanix VulnDB

CVE-2026-98594

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in certain Linux network drivers could leave behind leftover resources when hardware setup fails, potentially causing minor system problems until fixed by a kernel update.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
High
Impact
Denial Of Service
Component
OS kernel
Class
Other
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Failure to unregister MDIO bus and disconnect PHY resources registered by tg3_get_invariants() when tg3_init_one() subsequently fails, leaving dangling kernel resources on error paths guarded by USE_PHYLIB.

Why it matters to the business

Linux systems using Broadcom tg3 network adapters may experience resource leaks, potential memory exhaustion, or instability during driver initialization failures, increasing operational risk for servers and appliances until patched.

How an attack unfolds

An attacker with local access or ability to induce driver probe failures (via hardware manipulation or error injection) could trigger the incomplete cleanup path, though the low EPSS and lack of public exploits indicate remote code execution is not feasible.

How to fix it

Update to a Linux kernel containing the fix that calls tg3_mdio_fini() and disconnects the PHY unconditionally on error paths; apply the latest stable kernel for your distribution.

How to confirm the fix worked

Confirm the presence of tg3_mdio_fini() calls and USE_PHYLIB guards in tg3_init_one() error handling in the running kernel source or via vendor patch notes; test driver probe failure scenarios in a lab environment.

Typical attack path

  1. Identify systems with tg3 hardware and USE_PHYLIB enabled
  2. Cause or wait for tg3_init_one() failure after tg3_get_invariants() succeeds
  3. Observe leaked MDIO/PHY objects in kernel memory

How to detect it

Search kernel logs and dmesg for tg3 initialization sequences that reach tg3_get_invariants() but fail later in tg3_init_one(); no public exploit artifacts exist.

What your security team should do

  • Prioritize kernel updates on systems with tg3 adapters within standard patch windows given low EPSS
  • Monitor vendor advisories for backported fixes in supported LTS kernels
  • Review logs for tg3 probe failures as indirect indicators of exposure

The record

In the Linux kernel, the following vulnerability has been resolved: tg3: clean up PHYLIB resources on probe failure tg3_get_invariants() can register an MDIO bus and connect a PHY for USE_PHYLIB devices. If tg3_init_one() later fails, its common error path releases the mappings and netdev without undoing those PHYLIB resources. Disconnect the PHY and unregister the MDIO bus before the remaining teardown. Guard PHY cleanup with USE_PHYLIB to match tg3_phy_init(), and call tg3_mdio_fini() unconditionally to match tg3_mdio_init(). The existing IS_CONNECTED and MDIOBUS_INITED flags make both helpers safe when initialization only completed partially. This issue was identified during our ongoing static-analysis research while reviewing kernel code.

Affected packages

Ecosystem Package Introduced Fixed