CVE-2026-98565: net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621
In the Linux kernel, the following vulnerability has been resolved:
net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621
The core and io supplies are only requested for IDMT7530: both the devmregulatorget() in probe and the regulatorenable() in mt7530setup() are guarded by the switch id, but mt7530remove() disables them unconditionally. On an MT7621 or an MT7531 both pointers are still NULL from devmkzalloc(), so rmmod or a sysfs unbind calls regulatordisable() on NULL.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.159.1-1 - Upgrade
Upgrade
azurelinux/kernelto a version that resolves this vulnerability.Fixed in 6.6.159.1-1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are affected by the NULL dereference?
Systems using the MT7621 or MT7531 switch variants are affected when their MT7530 DSA driver instance is removed or unbound. The core and I/O regulator pointers are not requested for those IDs and remain NULL.
What action triggers the issue?
Removing the driver module with rmmod or unbinding the device through sysfs triggers the removal path. That path calls regulator_disable() unconditionally on the NULL regulator pointers.
Are MT7530 devices affected in the same way?
The described NULL-pointer condition is specific to MT7621 and MT7531. For ID_MT7530, the core and I/O supplies are requested during probe and enabled during setup.