In the Linux kernel, the following vulnerability has been resolved: net: phylink: record the PHY only once bringup cannot fail phylink_bringup_phy()… (CVE-2026-98563)

The Linux kernel's phylink subsystem had a vulnerability where phylink_bringup_phy() prematurely stored the PHY device pointer (pl->phydev) before a last fallible operation. On MACs implementing LPI, phy_eee_rx_clock_stop() can fail with a real MDIO error, causing callers to unwind with phy_detach() unaware of pl->phydev. This results in pl->phydev pointing to a freed phy_device, which subsequent functions like phylink_resolve() and ethtool helpers continue to access, leading to use-after-free conditions. The problem is exacerbated in the SFP path where error handling does not clear pl->phydev, leaving a dangling pointer. The vulnerability was discovered while ensuring DSA ports survive PHY drivers arriving late. The fix was to update pl->phydev only after the last call that can fail, ensuring no stale pointers remain and that PHY-side state order is preserved.

This vulnerability can lead to use-after-free conditions within the Linux kernel's phylink subsystem, potentially causing kernel crashes or undefined behavior when stale pointers to freed PHY devices are accessed. The impact depends on the caller context but generally risks system stability and reliability. There is no indication of remote code execution or privilege escalation from the provided data.

A fix has been implemented in the Linux kernel to address this issue by updating the PHY device pointer only after the last potentially failing call in phylink_bringup_phy(). Users should apply the official kernel updates that include this fix. Since this is a kernel-level vulnerability, upgrading to the patched kernel version is the recommended remediation. No additional mitigation steps are indicated in the advisory.