SB20261022171 - Missing Release of Resource after Effective Lifetime in Linux kernel ethernet broadcom driver

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261022171

SB20261022171 - Missing Release of Resource after Effective Lifetime in Linux kernel ethernet broadcom driver

Published: October 22, 2026

Security Bulletin ID SB20261022171
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Partial DoS

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98594)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a local privileged user to potentially cause a denial of service through unreleased kernel driver resources.

The vulnerability exists due to missing release of PHYLIB resources in the Linux kernel tg3 driver's initialization error path when device probing fails after an MDIO bus has been registered and a PHY connected. A local privileged user can potentially trigger this failure path to leave those resources associated with released mappings and network-device state, which may disrupt system operation.


Remediation

Install update from vendor's website.

References