CVE-2026-72411

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

net: dsa: mxl862xx: fix use-after-free of DSA ports in crc_err_work

Upon an MDIO CRC error mxl862xx_crc_err_work_fn() walks the DSA ports

and closes the CPU port conduits:

dsa_switch_for_each_cpu_port(dp, priv->ds)

dev_close(dp->conduit);

mxl862xx_remove() unregisters the switch before cancelling this work:

set_bit(MXL862XX_FLAG_WORK_STOPPED, &priv->flags);

cancel_delayed_work_sync(&priv->stats_work);

dsa_unregister_switch(ds);

mxl862xx_host_shutdown(priv);

dsa_unregister_switch() frees the dsa_port objects. If a CRC error

schedules the work during teardown it can run after the ports have been

freed and dereference freed memory.

Guard the port walk with MXL862XX_FLAG_WORK_STOPPED, which is already set

before dsa_unregister_switch(). DSA tears the ports down under

rtnl_lock(), so checking the flag under rtnl_lock() means the work either

runs before teardown and sees valid ports, or runs afterwards, observe

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References