CVE-2026-72411
Received Received - Intake

BaseFortify

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: dsa: mxl862xx: fix use-after-free of DSA ports in crc_err_work Upon an MDIO CRC error mxl862xx_crc_err_work_fn() walks the DSA ports and closes the CPU port conduits: dsa_switch_for_each_cpu_port(dp, priv->ds) dev_close(dp->conduit); mxl862xx_remove() unregisters the switch before cancelling this work: set_bit(MXL862XX_FLAG_WORK_STOPPED, &priv->flags); cancel_delayed_work_sync(&priv->stats_work); dsa_unregister_switch(ds); mxl862xx_host_shutdown(priv); dsa_unregister_switch() frees the dsa_port objects. If a CRC error schedules the work during teardown it can run after the ports have been freed and dereference freed memory. Guard the port walk with MXL862XX_FLAG_WORK_STOPPED, which is already set before dsa_unregister_switch(). DSA tears the ports down under rtnl_lock(), so checking the flag under rtnl_lock() means the work either runs before teardown and sees valid ports, or runs afterwards, observes the flag and skips the walk. This mirrors the host_flood_work handler, which skips torn-down ports under rtnl_lock().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-72411
EUVD
EUVD-2026-59310

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a use-after-free issue in the mxl862xx DSA driver. When an MDIO CRC error occurs, a work function attempts to close CPU port conduits by iterating over DSA ports. However, during driver teardown, the switch is unregistered before the work is cancelled, potentially freeing port objects while the work function still tries to access them. This leads to dereferencing freed memory.

Detection Guidance

This vulnerability involves a use-after-free condition in the Linux kernel's DSA (Distributed Switch Architecture) subsystem, specifically in the mxl862xx driver. Detection requires checking for kernel logs indicating CRC errors or crashes related to DSA ports. Monitor logs with commands like 'dmesg | grep -i crc_err' or 'journalctl -k | grep -i mxl862xx'. If crashes occur during network operations, it may indicate exploitation.

Impact Analysis

This vulnerability could cause system instability or crashes if exploited. It may lead to memory corruption, kernel panics, or unexpected behavior in network operations managed by the affected DSA driver. Systems using the mxl862xx switch hardware are primarily at risk.

Mitigation Strategies

Immediate mitigation involves updating the Linux kernel to a patched version where this issue is resolved. Check your distribution's updates or kernel.org for patches addressing CVE-2026-72411. If updating is not immediately possible, disable the mxl862xx driver or avoid using DSA ports until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72411. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart