Skip to main content

Linux Kernel CVE-2026-53232

| EUVDEUVD-2026-39323 HIGH
Use After Free (CWE-416)
2026-06-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-grrc-m4h5-r55j
Information Disclosure Linux Use After Free Memory Corruption
8.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain local/physical access to SFP-equipped host
  2. Delivery
    Induce PHY probe failure on interface
  3. Exploit
    Leave dangling sfp-bus upstream pointer
  4. Execution
    Trigger SFP module event
  5. Persist
    Kernel dereferences freed pointer
  6. Impact
    Kernel crash or memory corruption (DoS)

Vulnerability Assessment

Weakness
CWE
CWE-416
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires a system using a PHY driver with SFP cage support where phy_probe() fails (e.g., due to a problematic transceiver, driver, or device-tree/hardware configuration), AND a subsequent SFP event (module insert/remove or link change) that walks the stale 'upstream' reference. Limiting factors: the affected hardware path only exists on devices with SFP/SFP+ cages (switches, routers, NICs, embedded networking boards), the dangling pointer is only created on the probe-failure branch (not normal operation), and triggering generally needs local access or physical control of the SFP slot - contradicting the AV:A/PR:N CVSS vector, which is not supported by the description and should be verified with the vendor.
Impact

Signals here conflict and the published CVSS overstates real-world risk. The supplied CVSS 3.1 vector AV:A/AC:L/PR:N/UI:N/C:H/I:H/A:H (8.8) implies an unauthenticated adjacent-network attacker can fully compromise the host, but the description shows the trigger is a local PHY probe failure followed by a physical/driver-level SFP event - not a network packet. This is an auto-scored kernel CVE whose vector does not match the described mechanism: verify with vendor, as the adjacent-network and high-confidentiality claims are not supported by the text. Corroborating the low real risk, EPSS is 0.16% (5th percentile), there is no KEV listing and no public PoC. The 'Information Disclosure' tag is also questionable - a dangling-pointer dereference in this path is far more likely to cause a kernel crash (DoS) than a controlled info leak. Net: genuine memory-safety bug worth patching in the normal cycle, but not an emergency for most environments; only systems with hot-pluggable SFP/SFP+ networking hardware are realistically exposed.
Exploit ScenarioDerived

An attacker (or faulty hardware) causes PHY probing to fail on a network interface with an SFP cage, leaving the sfp-bus with a dangling upstream pointer; the attacker then induces an SFP event by inserting, removing, or toggling a transceiver module, causing the kernel to dereference freed state and crash or potentially corrupt memory. No public exploit code is identified, and realistically this typically manifests as a kernel oops/DoS rather than reliable code execution.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 28, 2026

Use of a dangling pointer in the Linux kernel's phylib/SFP networking subsystem occurs when PHY probing fails but sfp_bus_del_upstream() is never called, leaving the sfp-bus 'upstream' field pointing at freed/torn-down state that can be dereferenced during a later SFP hot-plug event. Affected systems are Linux hosts and appliances using PHY drivers with SFP cage support across kernels from 5.5 up to the fix in commit 48774e87. There is no public exploit identified at time of analysis, the EPSS score is very low (0.16%, 5th percentile), and the issue is not in CISA KEV.

RemediationAI

Patch available per vendor advisory: upstream fix is kernel commit 48774e87bbaa0056819d4b52301e4692e50e3252 (https://git.kernel.org/stable/c/48774e87bbaa0056819d4b52301e4692e50e3252), which adds the missing sfp_bus_del_upstream() call in the phy probe failure path; update to the stable release that incorporates this commit (no single tagged release number was provided in the input, so confirm the exact backported version against your distribution's kernel changelog). The released patched version is identified by commit rather than by a vendor-tagged release here, so confirm the build with your distro. There is no clean runtime workaround for a kernel memory-safety bug, but because the trigger requires a PHY probe failure plus an SFP event, exposure can be reduced by ensuring correct/known-good SFP modules and driver firmware, restricting physical and administrative access to systems with SFP cages, and avoiding loading/reloading affected PHY drivers on untrusted hardware - these reduce the chance of hitting the probe-failure path but do not eliminate the underlying defect.

Affected VersionsENISA

Linux 298e54fa810e027f1b0800d789eb862592721f08 <48774e87bbaa0056819d4b52301e4692e50e3252
Linux 5.5
Linux patch: 0
Linux patch: 7.1

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The flaw lives in the kernel networking PHY library (drivers/net/phy) and its SFP bus glue (sfp-bus). When a network device with an SFP cage is brought up, the PHY driver registers itself as the 'upstream' consumer of the sfp-bus via sfp_bus_add_upstream(); on teardown it must call sfp_bus_del_upstream() to detach. In the phy_probe failure path this detach was missing, so the sfp-bus retained a stale 'upstream' back-reference. A subsequent SFP module event (insertion/removal/link change) then walks that dangling reference - a classic use-after-free / dangling-pointer condition (closest CWE class CWE-416 Use After Free / CWE-825 Expired Pointer Dereference; the feed lists CWE as N/A). The bug predates generic phylib SFP support and also affected drivers that called phy_sfp_probe() directly.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY 8.8 HIGH
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 4.7 MEDIUM

Trigger is a local probe-failure race plus an SFP hardware event (AV:L, AC:H, PR:L); realistic impact is a kernel crash/DoS, so A:H with no confirmed confidentiality or integrity impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat 5.5 MEDIUM

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Jun 28, 2026 - 08:22 NVD
8.8 (HIGH)
Patch available
Jun 25, 2026 - 10:32 EUVD
CVE Published
Jun 25, 2026 - 09:16 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 25, 2026 - 09:16 cve.org
HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net: phy: clean the sfp upstream if phy probing fails

Sashiko reported that we don't call sfp_bus_del_upstream() in the probe failure path, so let's add it, otherwise the sfp-bus is left with a dangling 'upstream' field, that may be used later on during SFP events.

This issue existed before the generic phylib sfp support, back when drivers were calling phy_sfp_probe themselves.

Executive ViewAI

Why It Matters

CVE-2026-53232 affects the Linux kernel's SFP networking subsystem, creating a potential local code execution path through a use-after-free vulnerability (CVSS 8.8). However, real-world exploitation risk remains minimal: the vulnerability carries a 0.2% probability score, no public exploit identified at time of analysis, and it is not actively exploited. Organizations should apply available patches to Linux systems and network appliances with SFP hardware during normal maintenance cycles.

Business Impact: Medium
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 95% exploitable
Prevalence
Ubiquitous
Linux kernel runs everywhere; SFP/PHY path limited to networking hardware
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Controlled
Automatable· derived
No
Human Impact
Medium

Priority Score

44
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-53232 ADVISORY https://ubuntu.com/security/notices/USN-8726-1 ADVISORY https://ubuntu.com/security/notices/USN-8727-1 ADVISORY https://vuldb.com/vuln/373762 REF https://git.kernel.org/stable/c/0b27701ce93161d7bbf4b25fa20ca59963b0e20c REF https://git.kernel.org/stable/c/12fb84dc4dc8eb47ebe2b27f7de6255a4a205e1b REF https://git.kernel.org/stable/c/18c7c311323b19a353c3042180982e0ce5fa7e5f REF https://git.kernel.org/stable/c/3a254779c169954fe23328a1db51f67be374f913 REF https://git.kernel.org/stable/c/48774e87bbaa0056819d4b52301e4692e50e3252 REF https://git.kernel.org/stable/c/9326b654f90a09eadeb796c82801a5609d57f0c8

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy