{"id":"CVE-2026-98594","title":"tg3: clean up PHYLIB resources on probe failure","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ntg3: clean up PHYLIB resources on probe failure\n\ntg3_get_invariants() can register an MDIO bus and connect a PHY for\nUSE_PHYLIB devices. If tg3_init_one() later fails, …","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 158d7abdae85e9ac43d99780c372d79c119f7626 < ce86d6929d03e6b0abcb781dfa50f9f0816bff78","Linux >= 158d7abdae85e9ac43d99780c372d79c119f7626 < a449eedb3b1eb5b8b1f5ed116a1bfe85eaaf81df","Linux >= 158d7abdae85e9ac43d99780c372d79c119f7626 < 0844402326d4e48a28688f93ec6442e93bb442fa","Linux >= 158d7abdae85e9ac43d99780c372d79c119f7626 < e766321288b507afb70d2bfef6ba443213329f79","Linux >= 158d7abdae85e9ac43d99780c372d79c119f7626 < d2abb0013b933d59ee441185df0eca9e8c0b33eb","Linux >= 158d7abdae85e9ac43d99780c372d79c119f7626 < 6515c41503eef849abd2c7364f34e4bb25110f90","Linux >= 158d7abdae85e9ac43d99780c372d79c119f7626 < b6c0c757c65893ad7bb17e8bcf33cdd8257d7b3d","Linux >= 158d7abdae85e9ac43d99780c372d79c119f7626 < a92e1a412c53dc0d9ad639e7abf8b3fc70a5b6ad","Linux 2.6.27"],"published":"2026-10-18","updated":"2026-10-18","sourceUpdated":"2026-10-18T15:19:06.696Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98594","references":[{"url":"https://git.kernel.org/stable/c/ce86d6929d03e6b0abcb781dfa50f9f0816bff78"},{"url":"https://git.kernel.org/stable/c/a449eedb3b1eb5b8b1f5ed116a1bfe85eaaf81df"},{"url":"https://git.kernel.org/stable/c/0844402326d4e48a28688f93ec6442e93bb442fa"},{"url":"https://git.kernel.org/stable/c/e766321288b507afb70d2bfef6ba443213329f79"},{"url":"https://git.kernel.org/stable/c/d2abb0013b933d59ee441185df0eca9e8c0b33eb"},{"url":"https://git.kernel.org/stable/c/6515c41503eef849abd2c7364f34e4bb25110f90"},{"url":"https://git.kernel.org/stable/c/b6c0c757c65893ad7bb17e8bcf33cdd8257d7b3d"},{"url":"https://git.kernel.org/stable/c/a92e1a412c53dc0d9ad639e7abf8b3fc70a5b6ad"}],"tags":["cve.org"],"ingestedAt":"2026-10-18T15:45:12.248Z","slug":"CVE-2026-98594","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntg3: clean up PHYLIB resources on probe failure\n\ntg3_get_invariants() can register an MDIO bus and connect a PHY for\nUSE_PHYLIB devices. If tg3_init_one() later fails, its common error path\nreleases the mappings and netdev without undoing those PHYLIB resources.\n\nDisconnect the PHY and unregister the MDIO bus before the remaining\nteardown. Guard PHY cleanup with USE_PHYLIB to match tg3_phy_init(), and\ncall tg3_mdio_fini() unconditionally to match tg3_mdio_init(). The existing\nIS_CONNECTED and MDIOBUS_INITED flags make both helpers safe when\ninitialization only completed partially.\n\nThis issue was identified during our ongoing static-analysis research while\nreviewing kernel code.\n\n## Affected\n\n- `Linux >= 158d7abdae85e9ac43d99780c372d79c119f7626 < ce86d6929d03e6b0abcb781dfa50f9f0816bff78`\n- `Linux >= 158d7abdae85e9ac43d99780c372d79c119f7626 < a449eedb3b1eb5b8b1f5ed116a1bfe85eaaf81df`\n- `Linux >= 158d7abdae85e9ac43d99780c372d79c119f7626 < 0844402326d4e48a28688f93ec6442e93bb442fa`\n- `Linux >= 158d7abdae85e9ac43d99780c372d79c119f7626 < e766321288b507afb70d2bfef6ba443213329f79`\n- `Linux >= 158d7abdae85e9ac43d99780c372d79c119f7626 < d2abb0013b933d59ee441185df0eca9e8c0b33eb`\n- `Linux >= 158d7abdae85e9ac43d99780c372d79c119f7626 < 6515c41503eef849abd2c7364f34e4bb25110f90`\n- `Linux >= 158d7abdae85e9ac43d99780c372d79c119f7626 < b6c0c757c65893ad7bb17e8bcf33cdd8257d7b3d`\n- `Linux >= 158d7abdae85e9ac43d99780c372d79c119f7626 < a92e1a412c53dc0d9ad639e7abf8b3fc70a5b6ad`\n- `Linux 2.6.27`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}