CVE-2026-72391
kernel: net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy
Severity
LowRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · August 15, 2026
Updated · August 20, 2026
Description
A flaw was found in the Linux kernel. A memory leak vulnerability exists in the SFP (Small Form-Factor Pluggable) module handling within the networking subsystem. When a copper/RollBall SFP module is hot-removed, the associated MII (Media Independent Interface) bus structure is not properly deallocated. This oversight leads to a memory leak, which could potentially result in a Denial of Service (DoS) over an extended period due to resource exhaustion.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-772 · Missing Release of Resource after Effective Lifetime