CVE-2026-98305

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: dsa: mxl862xx: disable the stats poll on teardown

mxl862xx_setup() arms the stats poll before mxl862xx_setup_mdio(), and

nothing stops it until dsa_register_switch() has returned an error to

mxl862xx_probe(). DSA frees the dsa_port list before it returns, so a

poll that fires once .setup or a later step of dsa_tree_setup() has

failed walks freed ports. On shutdown the user ports stay registered,

and the WORK_STOPPED flag test in mxl862xx_get_stats64() is not atomic

with the cancel in mxl862xx_shutdown(), so a re-arm that read the flag

before it was set queues the poll after cancel_delayed_work_sync() has

returned.

Arm the poll once .setup has succeeded and stop it from a .teardown op,

which DSA calls on unregister and after a failed registration, in both

cases before it frees the ports. Use disable_delayed_work_sync() there

and in shutdown(): it drains a running poll as the cancel did and turns

every later atte

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References