CVE-2026-98305: net: dsa: mxl862xx: disable the stats poll on teardown
In the Linux kernel, the following vulnerability has been resolved:
net: dsa: mxl862xx: disable the stats poll on teardown
mxl862xxsetup() arms the stats poll before mxl862xxsetupmdio(), and nothing stops it until dsaregisterswitch() has returned an error to mxl862xxprobe(). DSA frees the dsaport list before it returns, so a poll that fires once .setup or a later step of dsatreesetup() has failed walks freed ports. On shutdown the user ports stay registered, and the WORKSTOPPED flag test in mxl862xxgetstats64() is not atomic with the cancel in mxl862xxshutdown(), so a re-arm that read the flag before it was set queues the poll after canceldelayedworksync() has returned.
Arm the poll once .setup has succeeded and stop it from a .teardown op, which DSA calls on unregister and after a failed registration, in both cases before it frees the ports. Use disabledelayedworksync() there and in shutdown(): it drains a running poll as the cancel did and turns every later attempt to queue the work into a no-op, so the re-arm cannot bring the poll back. remove() and the probe error path only set WORKSTOPPED, which crcerrwork tests before it walks the ports.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In net: dsa: mxl862xx, arm the stats poll only after mxl862xx_setup() succeeds, disable it from the .teardown operation and in mxl862xx_shutdown() using disable_delayed_work_sync(), and set WORK_STOPPED before freeing the DSA port list so later re-arm attempts become no-ops.
Event History
Frequently Asked Questions
When can this issue be triggered?
It can occur when switch setup or a later DSA tree setup step fails, allowing a statistics poll to access freed DSA port data. It can also occur during shutdown if the statistics poll is re-armed after work cancellation.
What access does an attacker need?
The CVSS vector specifies local access and low privileges, with no user interaction required. The provided data does not identify a specific user-facing trigger beyond the affected driver lifecycle paths.
What is the impact if exploitation succeeds?
The CVSS assessment indicates high impact to confidentiality, integrity, and availability. The underlying flaw involves a statistics polling work item walking freed port data.
What should be checked to determine exposure?
Determine whether the system uses the Linux kernel mxl862xx DSA switch driver and whether affected switch setup, unregister, probe-failure, or shutdown paths can occur. The supplied information does not provide affected kernel version ranges.