CVE-2026-72391 (GCVE-0-2026-72391)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:56 – Updated: 2026-08-17 05:13
VLAI
Title
net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy
Summary
In the Linux kernel, the following vulnerability has been resolved: net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy sfp_i2c_mdiobus_create() allocates the I2C MDIO bus with mdio_i2c_alloc(), a plain (non-devm) allocation, and registers it. sfp_i2c_mdiobus_destroy() only unregisters the bus and clears sfp->i2c_mii without calling mdiobus_free(). As the only reference to the bus is then cleared, the struct mii_bus is leaked. This is hit whenever a copper/RollBall SFP module that instantiated an MDIO bus is removed: sfp_sm_main() takes the global teardown path and calls sfp_i2c_mdiobus_destroy(). sfp_cleanup(), on driver unbind, frees sfp->i2c_mii directly, which is why the leak only triggered on module hot-removal and not on unbind. Free the bus in sfp_i2c_mdiobus_destroy() to match the allocation done in sfp_i2c_mdiobus_create().
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: e85b1347ace677c3822c12d9332dfaaffe594da6 , < 92dd9a522f01ef57f633a8c1953cf6d48ef2bcd5 (git)
Affected: e85b1347ace677c3822c12d9332dfaaffe594da6 , < d2c37f26d1a37f8177be5f354537f8ee3ec31cc2 (git)
Affected: e85b1347ace677c3822c12d9332dfaaffe594da6 , < 3183b6f5510c876a1c4b4a6bdc3d0ad8940fe742 (git)
Affected: e85b1347ace677c3822c12d9332dfaaffe594da6 , < 86d379fcf1b79bdf4bc2ac891297f30f63d041d8 (git)
Affected: e85b1347ace677c3822c12d9332dfaaffe594da6 , < 2381bf3f484e8e4fd89a225445872ec14e036ab5 (git)
Affected: e85b1347ace677c3822c12d9332dfaaffe594da6 , < 8f31efff9206f9f0adb853cad6916086aac4d5ef (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.1
Unaffected: 0 , < 6.1 (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/phy/sfp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "92dd9a522f01ef57f633a8c1953cf6d48ef2bcd5",
              "status": "affected",
              "version": "e85b1347ace677c3822c12d9332dfaaffe594da6",
              "versionType": "git"
            },
            {
              "lessThan": "d2c37f26d1a37f8177be5f354537f8ee3ec31cc2",
              "status": "affected",
              "version": "e85b1347ace677c3822c12d9332dfaaffe594da6",
              "versionType": "git"
            },
            {
              "lessThan": "3183b6f5510c876a1c4b4a6bdc3d0ad8940fe742",
              "status": "affected",
              "version": "e85b1347ace677c3822c12d9332dfaaffe594da6",
              "versionType": "git"
            },
            {
              "lessThan": "86d379fcf1b79bdf4bc2ac891297f30f63d041d8",
              "status": "affected",
              "version": "e85b1347ace677c3822c12d9332dfaaffe594da6",
              "versionType": "git"
            },
            {
              "lessThan": "2381bf3f484e8e4fd89a225445872ec14e036ab5",
              "status": "affected",
              "version": "e85b1347ace677c3822c12d9332dfaaffe594da6",
              "versionType": "git"
            },
            {
              "lessThan": "8f31efff9206f9f0adb853cad6916086aac4d5ef",
              "status": "affected",
              "version": "e85b1347ace677c3822c12d9332dfaaffe594da6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/phy/sfp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.1"
            },
            {
              "lessThan": "6.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy\n\nsfp_i2c_mdiobus_create() allocates the I2C MDIO bus with mdio_i2c_alloc(),\na plain (non-devm) allocation, and registers it. sfp_i2c_mdiobus_destroy()\nonly unregisters the bus and clears sfp-\u003ei2c_mii without calling\nmdiobus_free(). As the only reference to the bus is then cleared, the\nstruct mii_bus is leaked.\n\nThis is hit whenever a copper/RollBall SFP module that instantiated an MDIO\nbus is removed: sfp_sm_main() takes the global teardown path and calls\nsfp_i2c_mdiobus_destroy(). sfp_cleanup(), on driver unbind, frees\nsfp-\u003ei2c_mii directly, which is why the leak only triggered on module\nhot-removal and not on unbind.\n\nFree the bus in sfp_i2c_mdiobus_destroy() to match the allocation done in\nsfp_i2c_mdiobus_create()."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:13:45.125Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/92dd9a522f01ef57f633a8c1953cf6d48ef2bcd5"
        },
        {
          "url": "https://git.kernel.org/stable/c/d2c37f26d1a37f8177be5f354537f8ee3ec31cc2"
        },
        {
          "url": "https://git.kernel.org/stable/c/3183b6f5510c876a1c4b4a6bdc3d0ad8940fe742"
        },
        {
          "url": "https://git.kernel.org/stable/c/86d379fcf1b79bdf4bc2ac891297f30f63d041d8"
        },
        {
          "url": "https://git.kernel.org/stable/c/2381bf3f484e8e4fd89a225445872ec14e036ab5"
        },
        {
          "url": "https://git.kernel.org/stable/c/8f31efff9206f9f0adb853cad6916086aac4d5ef"
        }
      ],
      "title": "net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72391",
    "datePublished": "2026-08-15T05:56:19.842Z",
    "dateReserved": "2026-08-09T03:40:39.924Z",
    "dateUpdated": "2026-08-17T05:13:45.125Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72391",
      "date": "2026-09-20",
      "epss": "0.00205",
      "percentile": "0.10918"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/phy/sfp.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "92dd9a522f01ef57f633a8c1953cf6d48ef2bcd5",
                    "status": "affected",
                    "version": "e85b1347ace677c3822c12d9332dfaaffe594da6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d2c37f26d1a37f8177be5f354537f8ee3ec31cc2",
                    "status": "affected",
                    "version": "e85b1347ace677c3822c12d9332dfaaffe594da6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3183b6f5510c876a1c4b4a6bdc3d0ad8940fe742",
                    "status": "affected",
                    "version": "e85b1347ace677c3822c12d9332dfaaffe594da6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "86d379fcf1b79bdf4bc2ac891297f30f63d041d8",
                    "status": "affected",
                    "version": "e85b1347ace677c3822c12d9332dfaaffe594da6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2381bf3f484e8e4fd89a225445872ec14e036ab5",
                    "status": "affected",
                    "version": "e85b1347ace677c3822c12d9332dfaaffe594da6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8f31efff9206f9f0adb853cad6916086aac4d5ef",
                    "status": "affected",
                    "version": "e85b1347ace677c3822c12d9332dfaaffe594da6",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/phy/sfp.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.1"
                  },
                  {
                    "lessThan": "6.1",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy\n\nsfp_i2c_mdiobus_create() allocates the I2C MDIO bus with mdio_i2c_alloc(),\na plain (non-devm) allocation, and registers it. sfp_i2c_mdiobus_destroy()\nonly unregisters the bus and clears sfp-\u003ei2c_mii without calling\nmdiobus_free(). As the only reference to the bus is then cleared, the\nstruct mii_bus is leaked.\n\nThis is hit whenever a copper/RollBall SFP module that instantiated an MDIO\nbus is removed: sfp_sm_main() takes the global teardown path and calls\nsfp_i2c_mdiobus_destroy(). sfp_cleanup(), on driver unbind, frees\nsfp-\u003ei2c_mii directly, which is why the leak only triggered on module\nhot-removal and not on unbind.\n\nFree the bus in sfp_i2c_mdiobus_destroy() to match the allocation done in\nsfp_i2c_mdiobus_create()."
          }
        ],
        "id": "CVE-2026-72391",
        "lastModified": "2026-08-17T06:19:05.587",
        "metrics": {},
        "published": "2026-08-15T06:22:12.627",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2381bf3f484e8e4fd89a225445872ec14e036ab5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3183b6f5510c876a1c4b4a6bdc3d0ad8940fe742"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/86d379fcf1b79bdf4bc2ac891297f30f63d041d8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8f31efff9206f9f0adb853cad6916086aac4d5ef"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/92dd9a522f01ef57f633a8c1953cf6d48ef2bcd5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d2c37f26d1a37f8177be5f354537f8ee3ec31cc2"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-19T17:54:33+00:00",
      "cve": "CVE-2026-72391",
      "id": "CVE-2026-72391",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72391.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-02T11:46:32Z",
      "cve": "CVE-2026-72391",
      "id": "CVE-2026-72391",
      "initial_release_date": "2026-09-02T11:46:32Z",
      "product_status:known_affected": "77",
      "product_status:known_not_affected": "285",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72391",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72391.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.