The Linux kernel PHY subsystem can leave a dangling reference to the SFP bus when a phy probe fails. Because the cleanup function sfp_bus_del_upstream() is not called in this failure path, the upstream field remains pointing to freed memory. If a later SFP event uses this stale pointer, undefined kernel behavior can occur, potentially causing a crash or other fault. This is a classic use‑after‑free or null‑pointer dereference weakness. Based on the description, it is inferred that a later SFP event could dereference the stale pointer.

All versions of the Linux kernel that compile the generic phylib SFP support before the patch commit 48774e87bbaa0056819d4b52301e4692e50e3252 are impacted. The vulnerability applies to builds that use the legacy phy probing path and include the unmodified upstream cleanup code. No specific kernel versions are listed, so any system that has not yet adopted the commit is potentially affected.

Official severity metrics are not published and the entry is not listed in the CISA KEV catalog. Exploitation would require an attacker to induce a failed phy probe and then trigger a subsequent SFP event that accesses the dangling pointer. There are no documented public exploits, so the likelihood of exploitation remains uncertain. While the weakness could cause a kernel fault, the risk is considered low to moderate without further evidence of an active attack. Based on the description, it is inferred that an attacker with local access could trigger a phy probe failure followed by an SFP event to exercise the stale pointer.