CVE-2026-98565

Received Received - Intake

NULL Dereference in Linux Kernel MT7530 Switch Driver

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621 The core and io supplies are only requested for ID_MT7530: both the devm_regulator_get() in probe and the regulator_enable() in mt7530_setup() are guarded by the switch id, but mt7530_remove() disables them unconditionally. On an MT7621 or an MT7531 both pointers are still NULL from devm_kzalloc(), so rmmod or a sysfs unbind calls regulator_disable() on NULL.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98565

EUVD

EUVD-2026-103610

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	ddda1ac116c852bb969541ed53cffef7255c4961
Linux	Linux	ddda1ac116c852bb969541ed53cffef7255c4961
Linux	Linux	ddda1ac116c852bb969541ed53cffef7255c4961
Linux	Linux	ddda1ac116c852bb969541ed53cffef7255c4961
Linux	Linux	ddda1ac116c852bb969541ed53cffef7255c4961
Linux	Linux	5.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is a NULL pointer dereference issue in the Linux kernel's DSA (Distributed Switch Architecture) driver for MT7530 and MT7621 switches. It occurs during the unbind process when the driver is removed or unloaded. The problem is that the regulator disable operation is called unconditionally in the remove function, but the regulator pointers are NULL for MT7621 and MT7531 devices because they were never properly initialized.

Detection Guidance

This vulnerability is specific to the Linux kernel's MT7530/MT7621 DSA driver and may cause a NULL dereference during module unbind. Detection requires checking kernel logs for errors during rmmod or sysfs unbind operations. Look for messages like 'regulator_disable() on NULL' in dmesg or system logs.

Impact Analysis

This vulnerability can cause a kernel panic or system crash when unloading the MT7530 driver on affected systems. It may lead to unexpected system reboots or denial of service if the driver is unloaded while in use. Systems using MT7621 or MT7531 switches are particularly affected.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a local kernel issue causing a NULL dereference during unbind operations in specific network drivers, which does not involve data exposure or processing violations relevant to these regulations.

Mitigation Strategies

Apply the latest kernel update that includes the fix for this issue. Avoid unbinding the mt7530 module or triggering sysfs unbind operations until patched. Monitor kernel logs for related errors as a sign of exploitation.

Hi! I’m here to help you understand CVE-2026-98565. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70