{"id":"CVE-2026-53231","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: phy: don't try to setup PHY-driven SFP cages when using genphy\n\nWe don't have support for PHY-driver SFP cages with the genphy code.\n\nOn top of that, it was found …","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: phy: don't try to setup PHY-driven SFP cages when using genphy\n\nWe don't have support for PHY-driver SFP cages with the genphy code.\n\nOn top of that, it was found …","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-667"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 7.0, < 7.0.13","linux_kernel = 7.1"],"patched":["linux_kernel 7.0.13"],"published":"2026-06-25","updated":"2026-07-02","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-53231","references":[{"url":"https://git.kernel.org/stable/c/5a0082ec20a05ef2378410323a5089a8f1786f4a","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ef8d739eee6f85303cbecebc01eb72f063de74e0","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd"],"epss":0.00111,"epssPercentile":0.0148,"ingestedAt":"2026-07-03T13:02:28.078Z","slug":"CVE-2026-53231","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: phy: don't try to setup PHY-driven SFP cages when using genphy\n\nWe don't have support for PHY-driver SFP cages with the genphy code.\n\nOn top of that, it was found by sashiko that running\nsfp_bus_add_upstream() for genphy deadlocks, as for genphy the PHY\nprobing runs under RTNL, which isn't the case for non-genphy drivers.\n\nThis problem was reproduced, and does lead to a deadlock on RTNL.\n\nBefore the blamed commit, the phy_sfp_probe() call was made by\nindividual PHY drivers, so there was no way to get to the SFP probing\npath when using genphy.\n\nLet's therefore only run phy_sfp_probe when not using genphy.\n\n## Affected\n\n- `linux_kernel >= 7.0, < 7.0.13`\n- `linux_kernel = 7.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 7.0.13`","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}