SECUFOCUSNOW
Home›CVE index›CVE-2026-53232
Review reviewHigh

CVE-2026-53232

Linux Linux, linux kernel

In the Linux kernel, the following vulnerability has been resolved: net: phy: clean the sfp upstream if phy probing fails Sashiko reported that we don't call sfp_bus_del_upstream() in the probe failure path, so let's add it, otherwise the sfp-bus is left with a dangling 'upstream' field, that may be used later on during SFP events. This issue existed before the generic phylib sfp support, back when drivers were calling phy_sfp_probe themselves.

CVSS
8.8
EPSS
0.25%
16.9% percentile
CISA KEV
Not listed
Published
2026.06.25
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.25%
Technical severityCVSS 8.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: net: phy: clean the sfp upstream if phy probing fails Sashiko reported that we don't call sfp_bus_del_upstream() in the probe failure path, so let's add it, otherwise the sfp-bus is left with a dangling 'upstream' field, that may be used later on during SFP events. This issue existed before the generic phylib sfp support, back when drivers were calling phy_sfp_probe themselves.

Affected product and versions

Product
Linux Linux, linux kernel
Affected versions
>= 298e54fa810e027f1b0800d789eb862592721f08 < 12fb84dc4dc8eb47ebe2b27f7de6255a4a205e1b, >= 298e54fa810e027f1b0800d789eb862592721f08 < 9326b654f90a09eadeb796c82801a5609d57f0c8, >= 298e54fa810e027f1b0800d789eb862592721f08 < 3a254779c169954fe23328a1db51f67be374f913, >= 298e54fa810e027f1b0800d789eb862592721f08 < 0b27701ce93161d7bbf4b25fa20ca59963b0e20c, >= 298e54fa810e027f1b0800d789eb862592721f08 < 48774e87bbaa0056819d4b52301e4692e50e3252, >= 5.5, >= 5.5 < 7.1, 7.1
Fixed versions
7.1

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux Linux, linux kernel and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
Not available