---
id: CVE-2026-53232
title: 'net: phy: clean the sfp upstream if phy probing fails'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net: phy: clean the sfp upstream if phy probing fails

  Sashiko reported that we don't call sfp_bus_del_upstream() in the probe
  failure path, so let's add it, otherwise …
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 298e54fa810e027f1b0800d789eb862592721f08 <
    12fb84dc4dc8eb47ebe2b27f7de6255a4a205e1b
  - >-
    Linux >= 298e54fa810e027f1b0800d789eb862592721f08 <
    9326b654f90a09eadeb796c82801a5609d57f0c8
  - >-
    Linux >= 298e54fa810e027f1b0800d789eb862592721f08 <
    3a254779c169954fe23328a1db51f67be374f913
  - >-
    Linux >= 298e54fa810e027f1b0800d789eb862592721f08 <
    0b27701ce93161d7bbf4b25fa20ca59963b0e20c
  - >-
    Linux >= 298e54fa810e027f1b0800d789eb862592721f08 <
    48774e87bbaa0056819d4b52301e4692e50e3252
  - Linux 5.5
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:27:27.558655Z'
published: '2026-06-25'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:31:42.187Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-53232'
references:
  - url: 'https://git.kernel.org/stable/c/12fb84dc4dc8eb47ebe2b27f7de6255a4a205e1b'
  - url: 'https://git.kernel.org/stable/c/9326b654f90a09eadeb796c82801a5609d57f0c8'
  - url: 'https://git.kernel.org/stable/c/3a254779c169954fe23328a1db51f67be374f913'
  - url: 'https://git.kernel.org/stable/c/0b27701ce93161d7bbf4b25fa20ca59963b0e20c'
  - url: 'https://git.kernel.org/stable/c/48774e87bbaa0056819d4b52301e4692e50e3252'
tags:
  - cve.org
epss: 0.00254
epssPercentile: 0.15774
ingestedAt: '2026-10-16T17:24:46.739Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net: phy: clean the sfp upstream if phy probing fails

Sashiko reported that we don't call sfp_bus_del_upstream() in the probe
failure path, so let's add it, otherwise the sfp-bus is left with a
dangling 'upstream' field, that may be used later on during SFP events.

This issue existed before the generic phylib sfp support, back when
drivers were calling phy_sfp_probe themselves.

## Affected

- `Linux >= 298e54fa810e027f1b0800d789eb862592721f08 < 12fb84dc4dc8eb47ebe2b27f7de6255a4a205e1b`
- `Linux >= 298e54fa810e027f1b0800d789eb862592721f08 < 9326b654f90a09eadeb796c82801a5609d57f0c8`
- `Linux >= 298e54fa810e027f1b0800d789eb862592721f08 < 3a254779c169954fe23328a1db51f67be374f913`
- `Linux >= 298e54fa810e027f1b0800d789eb862592721f08 < 0b27701ce93161d7bbf4b25fa20ca59963b0e20c`
- `Linux >= 298e54fa810e027f1b0800d789eb862592721f08 < 48774e87bbaa0056819d4b52301e4692e50e3252`
- `Linux 5.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.