net: macb: put the "mdio" child node reference on success

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-97972
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-09-25 11:17:25 UTC
Updated2026-09-25 11:17:25 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: net: macb: put the "mdio" child node reference on success macb_mii_init() holds the reference returned by of_get_child_by_name() for macb_mdiobus_register() and drops it only on the error paths, so every successful probe leaks a node reference. On a CM5, overlay removal after four bind cycles reports OF: ERROR: memory leak, expected refcount 1 instead of 5 Drop the reference after registration, where __mdiobus_register() has already taken its own for the lifetime of the bus.

Risk And Classification

EPSS: 0.001660000 probability, percentile 0.051950000 (date 2026-09-27)

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 8a6631f1cece09047fa44608d21d520ca65ce7d8 5fba30080d298edb742396073372385c961578d3 git Not specified
CNA Linux Linux affected 8a6631f1cece09047fa44608d21d520ca65ce7d8 7d60dc7ff85b73a2119d582ca2d4456b30960380 git Not specified
CNA Linux Linux affected 8a6631f1cece09047fa44608d21d520ca65ce7d8 382a373d9ea7a6ac4de9c022385b6217f65ae3cc git Not specified
CNA Linux Linux affected 6.13 Not specified
CNA Linux Linux unaffected 6.13 semver Not specified
CNA Linux Linux unaffected 6.18.53 6.18.* semver Not specified
CNA Linux Linux unaffected 7.2.7 7.2.* semver Not specified
CNA Linux Linux unaffected 7.3-rc3 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/7d60dc7ff85b73a2119d582ca2d4456b30960380 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/382a373d9ea7a6ac4de9c022385b6217f65ae3cc 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/5fba30080d298edb742396073372385c961578d3 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report