Missing Release of Resource after Effective Lifetime in Linux kernel - CVE-2026-98594

Vulnerability identifier: #VU156897

CSH Severity: Low

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-98594

CWE-ID: CWE-772

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local privileged user to potentially cause a denial of service through unreleased kernel driver resources.

The vulnerability exists due to missing release of PHYLIB resources in the Linux kernel tg3 driver's initialization error path when device probing fails after an MDIO bus has been registered and a PHY connected. A local privileged user can potentially trigger this failure path to leave those resources associated with released mappings and network-device state, which may disrupt system operation.

Linux kernel
Ubuntu
linux-nvidia-tegra (Ubuntu package)
linux-nvidia-tegra-igx (Ubuntu package)
linux-nvidia-tegra-5.15 (Ubuntu package)
linux (Ubuntu package)
linux-gcp (Ubuntu package)
linux-oracle (Ubuntu package)
linux-aws (Ubuntu package)
linux-ibm (Ubuntu package)
linux-hwe-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux-nvidia-tegra (Ubuntu package) - update to 5.15.0-1070.72
linux-nvidia-tegra-igx (Ubuntu package) - update to 5.15.0-1059.59
linux-nvidia-tegra-5.15 (Ubuntu package) - update to 5.15.0-1070.72~20.04.1
linux (Ubuntu package) - update to 7.0.0-42.42
linux-gcp (Ubuntu package) - update to 7.0.0-1016.18
linux-oracle (Ubuntu package) - update to 7.0.0-1015.16
linux-aws (Ubuntu package) - update to 7.0.0-1016.17
linux-ibm (Ubuntu package) - update to 7.0.0-1017.17
linux-hwe-7.0 (Ubuntu package) - update to 7.0.0-42.42~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1017.17

• https://git.kernel.org/stable/c/0844402326d4e48a28688f93ec6442e93bb442fa
• https://git.kernel.org/stable/c/6515c41503eef849abd2c7364f34e4bb25110f90
• https://git.kernel.org/stable/c/a449eedb3b1eb5b8b1f5ed116a1bfe85eaaf81df
• https://git.kernel.org/stable/c/a92e1a412c53dc0d9ad639e7abf8b3fc70a5b6ad
• https://git.kernel.org/stable/c/b6c0c757c65893ad7bb17e8bcf33cdd8257d7b3d
• https://git.kernel.org/stable/c/ce86d6929d03e6b0abcb781dfa50f9f0816bff78
• https://git.kernel.org/stable/c/d2abb0013b933d59ee441185df0eca9e8c0b33eb
• https://git.kernel.org/stable/c/e766321288b507afb70d2bfef6ba443213329f79

• Missing Release of Resource after Effective Lifetime in Linux kernel ethernet broadcom driver
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux, linux-aws, linux-gcp and more
• Ubuntu update for linux-nvidia-tegra, linux-nvidia-tegra-5.15, linux-nvidia-tegra-igx
• Ubuntu update for linux, linux-aws, linux-aws-5.15 and more