Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: - net: dsa: felix: do not use devres for mdiobus. As explained in the commits: - 74b6d7d13307: “net: dsa: realtek: register the MDIO bus using devres”. - 5135e96a3dd2: “net: dsa: do not allocate the slavemiibus using devres”...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: phy: mdio: fix memory leak Syzbot reported a memory leak in the MDIO bus interface. The problem was due to incorrect state logic. The MDIOBUSALLOCATED state indicates two possible states: 1. The bus is only allocated. 2. The bus ...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: netsec: fixed error handling in netsecregistermdio. If phydeviceregister fails, phydevicefree must be called to reset the reference count; thus, the memory associated with the phy device and its name can be freed in the...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: mdio: Fixed an unbalanced fwnode reference count in mdiodevicerelease. There is a warning report regarding a refcount leak when probing the mdio device: OF: Error: Memory leak; the expected refcount was 1 instead of 2. The...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mv88e6xxx: Do not use devres for mdiobus As explained in the commits: 74b6d7d13307 “net: dsa: realtek: Register the MDIO bus under devres” 5135e96a3dd2 “net: dsa: Do not allocate the slavemiibus using devres” The...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: net: dsa: bcmsf2: Fixed a possible memory leak in bcmsf2mdioregister. The bcmsf2mdioregister function calls ofPhyFindDevice and then phydeviceRemove in a loop to remove existing PHY devices. ofPhyFindDevice eventually calls...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: In the net subsystem, for the dsa module, in the mv88e6xxx code path, there was a issue with the refcount leak in the mv88e6xxxmdiosregister function. The ofgetchildbyname function returns a node pointer whose refcount is...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: mdio: fixed an undefined behavior in bit shifting for mdiobusregister. Shifting a signed 32-bit value by 31 bits is undefined; therefore, the significant bit was changed to unsigned. The UBSAN warning appears as follows:...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: usb: asix: It was resolved that holding the PM usage reference is necessary to avoid deadlocks between PM and MDIO operations along with RTNL. Prevent USB runtime PM autosuspend for AX88772 in bind. usbnet enables runtime PM...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: net: dsa: Fixed possible memory leaks in dsaloopinit. kmemleak: Reported memory leaks in dsaloopinit: kmemleak: 12 new suspected memory leaks. Unreferenced object 0xffff8880138ce000 size 2048: comm "modprobe", pid 390, jiffies...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: r6040: Fix kmemleak in probe and remove There is a memory leaks reported by kmemleak: unreferenced object 0xffff888116111000 size 2048: comm "modprobe", pid 817, jiffies 4294759745 age 76.502s hex dump first 32 bytes: 00 c4 0a 04...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: mdio: unexport init-annotated mdiobusinit EXPORTSYMBOL and init are a bad combination because the .init.text section is freed after initialization. As a result, modules cannot use symbols annotated with init. Accessing a fre...

Linux Distros Unpatched Vulnerability : CVE-2026-72391

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: phy: sfp: free miibus in sfpi2cmdiobusdestroy sfpi2cmdiobuscreate allocates the I2C MDIO bus with mdioi2calloc, a plain non-devm allocation, and registers...

CVE-2026-72411

A flaw was found in the Linux kernel's mxl862xx Digital Subscriber Line DSA driver. An issue during the driver's teardown process, specifically when handling MDIO CRC errors, can lead to a use-after-free vulnerability. This allows the system to attempt to access memory that has already been...

CVE-2026-72391

In the Linux kernel, the following vulnerability has been resolved: net: phy: sfp: free miibus in sfpi2cmdiobusdestroy sfpi2cmdiobuscreate allocates the I2C MDIO bus with mdioi2calloc, a plain non-devm allocation, and registers it. sfpi2cmdiobusdestroy only unregisters the bus and clears sfp-i2cm...

CVE-2026-72391

In the Linux kernel, the following vulnerability has been resolved: net: phy: sfp: free miibus in sfpi2cmdiobusdestroy sfpi2cmdiobuscreate allocates the I2C MDIO bus with mdioi2calloc, a plain non-devm allocation, and registers it. sfpi2cmdiobusdestroy only unregisters the bus and clears sfp-i2cm...

UBUNTU-CVE-2026-72391

In the Linux kernel, the following vulnerability has been resolved: net: phy: sfp: free miibus in sfpi2cmdiobusdestroy sfpi2cmdiobuscreate allocates the I2C MDIO bus with mdioi2calloc, a plain non-devm allocation, and registers it. sfpi2cmdiobusdestroy only unregisters the bus and clears sfp-i2cm...

CVE-2026-72391

Summary: CVE-2026-72391 affects the Linux kernel’s SFP MDIO bus handling. The code path in net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy previously leaked the struct mii_bus. The creation path allocates the I2C MDIO bus with mdio_i2c_alloc() (plain non-devm allocation) and registers it, ...

CVE-2026-72391 net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy

In the Linux kernel, the following vulnerability has been resolved: net: phy: sfp: free miibus in sfpi2cmdiobusdestroy sfpi2cmdiobuscreate allocates the I2C MDIO bus with mdioi2calloc, a plain non-devm allocation, and registers it. sfpi2cmdiobusdestroy only unregisters the bus and clears sfp-i2cm...

PT-2026-72579

In the Linux kernel, the following vulnerability has been resolved: net: phy: sfp: free mii bus in sfp i2c mdiobus destroy sfp i2c mdiobus create allocates the I2C MDIO bus with mdio i2c alloc, a plain non-devm allocation, and registers it. sfp i2c mdiobus destroy only unregisters the bus and...