CVE-2026-98563

A flaw was found in the Linux kernel's phylink component. When an error occurs during Ethernet physical layer (PHY) device initialization, the kernel prematurely stores a reference to the device before setup finishes. If the bringup operation fails, the device is detached and freed, but the kernel retains a stale pointer. A local user with administrative privileges or network hardware events triggering connection retries can cause the kernel to access this freed memory, leading to memory corruption or a Denial of Service (DoS) via a system crash.

This vulnerability is rated as having Moderate impact because exploitation requires either local administrative access or specific physical hardware failure events during PHY link initialization. The affected phylink subsystem is primarily utilized by specialized network adapters and embedded architectures rather than standard enterprise network controllers. Furthermore, the consequence is limited to a local denial of service via a kernel crash caused by dereferencing stale memory upon connection retry.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.