Published Sep 25, 2026Sources checked Oct 21, 2026
N/ACVSS not listedScore unavailable
What this means
Review the available evidence
CVE-2026-97972. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.
CISA KEVNot listedBased on the latest collected catalog
EPSS0.2%Estimated 30-day exploitation probability
Ransomware useNot markedCISA KEV ransomware field
Threat actors0Source-linked actor relationships
Overview
What is CVE-2026-97972?
In the Linux kernel, the following vulnerability has been resolved:
net: macb: put the "mdio" child node reference on success
macb_mii_init() holds the reference returned by of_get_child_by_name() for macb_mdiobus_register() and drops it only on the error paths, so every successful probe leaks a node reference. On a CM5, overlay removal after four bind cycles reports
OF: ERROR: memory leak, expected refcount 1 instead of 5
Drop the reference after registration, where __mdiobus_register() has already taken its own for the lifetime of the bus.