CVE-2026-98563

In the Linux kernel, the following vulnerability has been resolved:

net: phylink: record the PHY only once bringup cannot fail

phylink bringup phy() stores the PHY in pl->phydev before its last fallible step: on a MAC whose phylink ops implement LPI, phy eee rx clock stop() can fail with a real MDIO error. The callers unwind with phy detach(), which knows nothing about pl->phydev, so a pointer to a PHY that is no longer attached outlives the failed connect.

What that costs depends on how the caller got here. phylink connect phy() goes through phylink attach phy(), which refuses to attach while pl->phydev is set, turning a transient MDIO error into a permanent -EBUSY. The SFP path is worse than that: sfp sm probe phy() answers the failure with phy device remove() and phy device free(), and it assigns sfp->mod phy only past that error return, so nothing clears pl->phydev and it is left pointing at a freed phy device that phylink resolve() and the ethtool helpers go on reading. phylink fwnode phy connect() has no such check, so a later connect overwrites the stale pointer and hides the problem. A disconnect does not: phylink disconnect phy() hands that pointer to phy disconnect(), and the second phy detach() on the same PHY drops references the first one already released.

Found while making a DSA port survive a PHY whose driver arrives after the switch probes: keeping the port across a failed connect and retrying is what makes this window reachable.

Publish the pointer after the last call that can fail instead of unwinding it afterwards. Nothing between the two points reads pl->phydev, and the registration that follows cannot fail: phy request interrupt() falls back to polling on its own. The PHY-side state keeps the order it had, so no MDIO operation moves relative to another.