CVE-2026-72391

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy

sfp_i2c_mdiobus_create() allocates the I2C MDIO bus with mdio_i2c_alloc(),

a plain (non-devm) allocation, and registers it. sfp_i2c_mdiobus_destroy()

only unregisters the bus and clears sfp->i2c_mii without calling

mdiobus_free(). As the only reference to the bus is then cleared, the

struct mii_bus is leaked.

This is hit whenever a copper/RollBall SFP module that instantiated an MDIO

bus is removed: sfp_sm_main() takes the global teardown path and calls

sfp_i2c_mdiobus_destroy(). sfp_cleanup(), on driver unbind, frees

sfp->i2c_mii directly, which is why the leak only triggered on module

hot-removal and not on unbind.

Free the bus in sfp_i2c_mdiobus_destroy() to match the allocation done in

sfp_i2c_mdiobus_create().

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References