CVE-2026-97972

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97972", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:18:58.207Z", "datePublished": "2026-09-25T10:23:12.139Z", "dateUpdated": "2026-10-19T09:11:38.115Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:11:38.115Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: macb: put the \"mdio\" child node reference on success\n\nmacb_mii_init() holds the reference returned by of_get_child_by_name()\nfor macb_mdiobus_register() and drops it only on the error paths, so\nevery successful probe leaks a node reference. On a CM5, overlay\nremoval after four bind cycles reports\n\n OF: ERROR: memory leak, expected refcount 1 instead of 5\n\nDrop the reference after registration, where __mdiobus_register() has\nalready taken its own for the lifetime of the bus."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/cadence/macb_main.c"], "versions": [{"version": "8a6631f1cece09047fa44608d21d520ca65ce7d8", "lessThan": "5fba30080d298edb742396073372385c961578d3", "status": "affected", "versionType": "git"}, {"version": "8a6631f1cece09047fa44608d21d520ca65ce7d8", "lessThan": "7d60dc7ff85b73a2119d582ca2d4456b30960380", "status": "affected", "versionType": "git"}, {"version": "8a6631f1cece09047fa44608d21d520ca65ce7d8", "lessThan": "382a373d9ea7a6ac4de9c022385b6217f65ae3cc", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/cadence/macb_main.c"], "versions": [{"version": "6.13", "status": "affected"}, {"version": "0", "lessThan": "6.13", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/5fba30080d298edb742396073372385c961578d3"}, {"url": "https://git.kernel.org/stable/c/7d60dc7ff85b73a2119d582ca2d4456b30960380"}, {"url": "https://git.kernel.org/stable/c/382a373d9ea7a6ac4de9c022385b6217f65ae3cc"}], "title": "net: macb: put the \"mdio\" child node reference on success", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/cadence/macb_main.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "5fba30080d298edb742396073372385c961578d3", "status": "affected", "version": "8a6631f1cece09047fa44608d21d520ca65ce7d8", "versionType": "git"}, {"lessThan": "7d60dc7ff85b73a2119d582ca2d4456b30960380", "status": "affected", "version": "8a6631f1cece09047fa44608d21d520ca65ce7d8", "versionType": "git"}, {"lessThan": "382a373d9ea7a6ac4de9c022385b6217f65ae3cc", "status": "affected", "version": "8a6631f1cece09047fa44608d21d520ca65ce7d8", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/cadence/macb_main.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.13"}, {"lessThan": "6.13", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: macb: put the \"mdio\" child node reference on success\n\nmacb_mii_init() holds the reference returned by of_get_child_by_name()\nfor macb_mdiobus_register() and drops it only on the error paths, so\nevery successful probe leaks a node reference. On a CM5, overlay\nremoval after four bind cycles reports\n\n OF: ERROR: memory leak, expected refcount 1 instead of 5\n\nDrop the reference after registration, where __mdiobus_register() has\nalready taken its own for the lifetime of the bus."}], "id": "CVE-2026-97972", "lastModified": "2026-10-19T10:17:48.580", "metrics": {}, "published": "2026-09-25T11:17:25.090", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/382a373d9ea7a6ac4de9c022385b6217f65ae3cc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5fba30080d298edb742396073372385c961578d3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7d60dc7ff85b73a2119d582ca2d4456b30960380"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: net: macb: put the \"mdio\" child node reference on success", "id": "2541213", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541213"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-911", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet: macb: put the \"mdio\" child node reference on success\nmacb_mii_init() holds the reference returned by of_get_child_by_name()\nfor macb_mdiobus_register() and drops it only on the error paths, so\nevery successful probe leaks a node reference. On a CM5, overlay\nremoval after four bind cycles reports\nOF: ERROR: memory leak, expected refcount 1 instead of 5\nDrop the reference after registration, where __mdiobus_register() has\nalready taken its own for the lifetime of the bus.", "A flaw was found in the Linux kernel's Cadence MACB ethernet driver. During network interface initialization, the driver fails to properly release a device tree node reference upon successful registration. Repeated device probe or bind cycles can result in a reference count leak and progressive memory leak, which may lead to a Denial of Service (DoS) due to kernel resource exhaustion."], "name": "CVE-2026-97972", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-97972\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-97972\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97972.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8a6631f1cece09047fa44608d21d520ca65ce7d8,5fba30080d298edb742396073372385c961578d3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8a6631f1cece09047fa44608d21d520ca65ce7d8,7d60dc7ff85b73a2119d582ca2d4456b30960380)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8a6631f1cece09047fa44608d21d520ca65ce7d8,382a373d9ea7a6ac4de9c022385b6217f65ae3cc)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.13"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.13)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.7,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T19:30:20.154272+00:00", "updated": "2026-10-01T08:00:04.583272+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}