Linux Kernel DSA mxl862xx Statistics Poll Accesses a Freed Port Structure, Yielding a Use-After-Free

Status: UPDATED  |  Advisory ID: CVE-2026-98305

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

net: dsa: mxl862xx: disable the stats poll on teardown

mxl862xx_setup() arms the stats poll before mxl862xx_setup_mdio(), and

nothing stops it until dsa_register_switch() has returned an error to

mxl862xx_probe(). DSA frees the dsa_port list before it returns, so a

poll that fires once .setup or a later step of dsa_tree_setup() has

failed walks freed ports. On shutdown the user ports stay registered,

and the WORK_STOPPED flag test in mxl862xx_get_stats64() is not atomic

with the cancel in mxl862xx_shutdown(), so a re-arm that read the flag

before it was set queues the poll after cancel_delayed_work_sync() has

returned.

Arm the poll once .setup has succeeded and stop it from a .teardown op,

which DSA calls on unregister and after a failed registration, in both

cases before it frees the ports. Use disable_delayed_work_sync() there

and in shutdown(): it drains a running poll as the cancel did and turns

every later attempt to queue the work into a no-op, so the re-arm

cannot bring the poll back. remove() and the probe error path only set

WORK_STOPPED, which crc_err_work tests before it walks the ports. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References