CVE-2026-98594

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98594", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.359Z", "datePublished": "2026-10-18T15:19:06.696Z", "dateUpdated": "2026-10-19T09:22:19.792Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:22:19.792Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntg3: clean up PHYLIB resources on probe failure\n\ntg3_get_invariants() can register an MDIO bus and connect a PHY for\nUSE_PHYLIB devices. If tg3_init_one() later fails, its common error path\nreleases the mappings and netdev without undoing those PHYLIB resources.\n\nDisconnect the PHY and unregister the MDIO bus before the remaining\nteardown. Guard PHY cleanup with USE_PHYLIB to match tg3_phy_init(), and\ncall tg3_mdio_fini() unconditionally to match tg3_mdio_init(). The existing\nIS_CONNECTED and MDIOBUS_INITED flags make both helpers safe when\ninitialization only completed partially.\n\nThis issue was identified during our ongoing static-analysis research while\nreviewing kernel code."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/broadcom/tg3.c"], "versions": [{"version": "158d7abdae85e9ac43d99780c372d79c119f7626", "lessThan": "ce86d6929d03e6b0abcb781dfa50f9f0816bff78", "status": "affected", "versionType": "git"}, {"version": "158d7abdae85e9ac43d99780c372d79c119f7626", "lessThan": "a449eedb3b1eb5b8b1f5ed116a1bfe85eaaf81df", "status": "affected", "versionType": "git"}, {"version": "158d7abdae85e9ac43d99780c372d79c119f7626", "lessThan": "0844402326d4e48a28688f93ec6442e93bb442fa", "status": "affected", "versionType": "git"}, {"version": "158d7abdae85e9ac43d99780c372d79c119f7626", "lessThan": "e766321288b507afb70d2bfef6ba443213329f79", "status": "affected", "versionType": "git"}, {"version": "158d7abdae85e9ac43d99780c372d79c119f7626", "lessThan": "d2abb0013b933d59ee441185df0eca9e8c0b33eb", "status": "affected", "versionType": "git"}, {"version": "158d7abdae85e9ac43d99780c372d79c119f7626", "lessThan": "6515c41503eef849abd2c7364f34e4bb25110f90", "status": "affected", "versionType": "git"}, {"version": "158d7abdae85e9ac43d99780c372d79c119f7626", "lessThan": "b6c0c757c65893ad7bb17e8bcf33cdd8257d7b3d", "status": "affected", "versionType": "git"}, {"version": "158d7abdae85e9ac43d99780c372d79c119f7626", "lessThan": "a92e1a412c53dc0d9ad639e7abf8b3fc70a5b6ad", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/broadcom/tg3.c"], "versions": [{"version": "2.6.27", "status": "affected"}, {"version": "0", "lessThan": "2.6.27", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.271", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.55", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.27", "versionEndExcluding": "5.10.271"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.27", "versionEndExcluding": "5.15.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.27", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.27", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.27", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.27", "versionEndExcluding": "6.18.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.27", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.27", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ce86d6929d03e6b0abcb781dfa50f9f0816bff78"}, {"url": "https://git.kernel.org/stable/c/a449eedb3b1eb5b8b1f5ed116a1bfe85eaaf81df"}, {"url": "https://git.kernel.org/stable/c/0844402326d4e48a28688f93ec6442e93bb442fa"}, {"url": "https://git.kernel.org/stable/c/e766321288b507afb70d2bfef6ba443213329f79"}, {"url": "https://git.kernel.org/stable/c/d2abb0013b933d59ee441185df0eca9e8c0b33eb"}, {"url": "https://git.kernel.org/stable/c/6515c41503eef849abd2c7364f34e4bb25110f90"}, {"url": "https://git.kernel.org/stable/c/b6c0c757c65893ad7bb17e8bcf33cdd8257d7b3d"}, {"url": "https://git.kernel.org/stable/c/a92e1a412c53dc0d9ad639e7abf8b3fc70a5b6ad"}], "title": "tg3: clean up PHYLIB resources on probe failure", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/broadcom/tg3.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ce86d6929d03e6b0abcb781dfa50f9f0816bff78", "status": "affected", "version": "158d7abdae85e9ac43d99780c372d79c119f7626", "versionType": "git"}, {"lessThan": "a449eedb3b1eb5b8b1f5ed116a1bfe85eaaf81df", "status": "affected", "version": "158d7abdae85e9ac43d99780c372d79c119f7626", "versionType": "git"}, {"lessThan": "0844402326d4e48a28688f93ec6442e93bb442fa", "status": "affected", "version": "158d7abdae85e9ac43d99780c372d79c119f7626", "versionType": "git"}, {"lessThan": "e766321288b507afb70d2bfef6ba443213329f79", "status": "affected", "version": "158d7abdae85e9ac43d99780c372d79c119f7626", "versionType": "git"}, {"lessThan": "d2abb0013b933d59ee441185df0eca9e8c0b33eb", "status": "affected", "version": "158d7abdae85e9ac43d99780c372d79c119f7626", "versionType": "git"}, {"lessThan": "6515c41503eef849abd2c7364f34e4bb25110f90", "status": "affected", "version": "158d7abdae85e9ac43d99780c372d79c119f7626", "versionType": "git"}, {"lessThan": "b6c0c757c65893ad7bb17e8bcf33cdd8257d7b3d", "status": "affected", "version": "158d7abdae85e9ac43d99780c372d79c119f7626", "versionType": "git"}, {"lessThan": "a92e1a412c53dc0d9ad639e7abf8b3fc70a5b6ad", "status": "affected", "version": "158d7abdae85e9ac43d99780c372d79c119f7626", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/broadcom/tg3.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.27"}, {"lessThan": "2.6.27", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.271", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.222", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.55", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntg3: clean up PHYLIB resources on probe failure\n\ntg3_get_invariants() can register an MDIO bus and connect a PHY for\nUSE_PHYLIB devices. If tg3_init_one() later fails, its common error path\nreleases the mappings and netdev without undoing those PHYLIB resources.\n\nDisconnect the PHY and unregister the MDIO bus before the remaining\nteardown. Guard PHY cleanup with USE_PHYLIB to match tg3_phy_init(), and\ncall tg3_mdio_fini() unconditionally to match tg3_mdio_init(). The existing\nIS_CONNECTED and MDIOBUS_INITED flags make both helpers safe when\ninitialization only completed partially.\n\nThis issue was identified during our ongoing static-analysis research while\nreviewing kernel code."}], "id": "CVE-2026-98594", "lastModified": "2026-10-19T10:19:20.620", "metrics": {}, "published": "2026-10-18T16:17:12.043", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0844402326d4e48a28688f93ec6442e93bb442fa"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6515c41503eef849abd2c7364f34e4bb25110f90"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a449eedb3b1eb5b8b1f5ed116a1bfe85eaaf81df"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a92e1a412c53dc0d9ad639e7abf8b3fc70a5b6ad"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b6c0c757c65893ad7bb17e8bcf33cdd8257d7b3d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ce86d6929d03e6b0abcb781dfa50f9f0816bff78"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d2abb0013b933d59ee441185df0eca9e8c0b33eb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e766321288b507afb70d2bfef6ba443213329f79"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: tg3: clean up PHYLIB resources on probe failure", "id": "2554930", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554930"}, "csaw": false, "cvss3": {"cvss3_base_score": "1.9", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-772", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ntg3: clean up PHYLIB resources on probe failure\ntg3_get_invariants() can register an MDIO bus and connect a PHY for\nUSE_PHYLIB devices. If tg3_init_one() later fails, its common error path\nreleases the mappings and netdev without undoing those PHYLIB resources.\nDisconnect the PHY and unregister the MDIO bus before the remaining\nteardown. Guard PHY cleanup with USE_PHYLIB to match tg3_phy_init(), and\ncall tg3_mdio_fini() unconditionally to match tg3_mdio_init(). The existing\nIS_CONNECTED and MDIOBUS_INITED flags make both helpers safe when\ninitialization only completed partially.\nThis issue was identified during our ongoing static-analysis research while\nreviewing kernel code.", "A flaw was found in the Linux kernel's Broadcom Tigon3 (tg3) ethernet driver. When the driver encounters an error during device initialization, it fails to properly release and unregister associated networking hardware resources. A local user capable of triggering initialization failures could exploit this flaw, leading to unreleased kernel resources and a potential Denial of Service (DoS) due to system instability."], "name": "CVE-2026-98594", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98594\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98594\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98594.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[158d7abdae85e9ac43d99780c372d79c119f7626,ce86d6929d03e6b0abcb781dfa50f9f0816bff78)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[158d7abdae85e9ac43d99780c372d79c119f7626,a449eedb3b1eb5b8b1f5ed116a1bfe85eaaf81df)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[158d7abdae85e9ac43d99780c372d79c119f7626,0844402326d4e48a28688f93ec6442e93bb442fa)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[158d7abdae85e9ac43d99780c372d79c119f7626,e766321288b507afb70d2bfef6ba443213329f79)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[158d7abdae85e9ac43d99780c372d79c119f7626,d2abb0013b933d59ee441185df0eca9e8c0b33eb)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[158d7abdae85e9ac43d99780c372d79c119f7626,6515c41503eef849abd2c7364f34e4bb25110f90)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[158d7abdae85e9ac43d99780c372d79c119f7626,b6c0c757c65893ad7bb17e8bcf33cdd8257d7b3d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[158d7abdae85e9ac43d99780c372d79c119f7626,a92e1a412c53dc0d9ad639e7abf8b3fc70a5b6ad)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.27"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,2.6.27)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.271,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.222,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.189,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.158,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.112,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.55,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.9,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T23:00:12.910229+00:00", "updated": "2026-10-22T22:00:15.028361+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}