In the Linux kernel, the following vulnerability has been resolved: net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy sfp_i2c_mdiobus_create() allocates the I2C MDIO bus with mdio_i2c_alloc(), a plain (non-devm) allocation, and registers it. sfp_i2c_mdiobus_destroy() only unregisters the bus and clears sfp->i2c_mii without calling mdiobus_free(). As the only reference to the bus is then cleared, the struct mii_bus is leaked. This is hit whenever a copper/RollBall SFP module that instantiated an MDIO bus is removed: sfp_sm_main() takes the global teardown path and calls sfp_i2c_mdiobus_destroy(). sfp_cleanup(), on driver unbind, frees sfp->i2c_mii directly, which is why the leak only triggered on module hot-removal and not on unbind. Free the bus in sfp_i2c_mdiobus_destroy() to match the allocation done in sfp_i2c_mdiobus_create().

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00215.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
References
Link Providers
https://git.kernel.org/stable/c/2381bf3f484e8e4fd89a225445872ec14e036ab5 cve-icon cve-icon
https://git.kernel.org/stable/c/3183b6f5510c876a1c4b4a6bdc3d0ad8940fe742 cve-icon cve-icon
https://git.kernel.org/stable/c/86d379fcf1b79bdf4bc2ac891297f30f63d041d8 cve-icon cve-icon
https://git.kernel.org/stable/c/8f31efff9206f9f0adb853cad6916086aac4d5ef cve-icon cve-icon
https://git.kernel.org/stable/c/92dd9a522f01ef57f633a8c1953cf6d48ef2bcd5 cve-icon cve-icon
https://git.kernel.org/stable/c/d2c37f26d1a37f8177be5f354537f8ee3ec31cc2 cve-icon cve-icon
History

Sat, 15 Aug 2026 18:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-401

Sat, 15 Aug 2026 06:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy sfp_i2c_mdiobus_create() allocates the I2C MDIO bus with mdio_i2c_alloc(), a plain (non-devm) allocation, and registers it. sfp_i2c_mdiobus_destroy() only unregisters the bus and clears sfp->i2c_mii without calling mdiobus_free(). As the only reference to the bus is then cleared, the struct mii_bus is leaked. This is hit whenever a copper/RollBall SFP module that instantiated an MDIO bus is removed: sfp_sm_main() takes the global teardown path and calls sfp_i2c_mdiobus_destroy(). sfp_cleanup(), on driver unbind, frees sfp->i2c_mii directly, which is why the leak only triggered on module hot-removal and not on unbind. Free the bus in sfp_i2c_mdiobus_destroy() to match the allocation done in sfp_i2c_mdiobus_create().
Title net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-15T05:56:19.842Z

Reserved: 2026-08-09T03:40:39.924Z

Link: CVE-2026-72391

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-15T06:22:12.627

Modified: 2026-08-15T06:22:12.627

Link: CVE-2026-72391

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-15T18:30:12Z