Look up another CVE · open CVE-2026-98305 in the interactive tracker
CVE-2026-98305
net: dsa: mxl862xx: disable the stats poll on teardown
Published 2026-10-06 (13 days ago) by the Linux kernel CNA. Subsystem drivers/net. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-98305 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | not affected | 6.12.113-1 | Nothing to do. trixie never shipped the vulnerable code. |
| Debian 14forky | fixed | 7.2.8-1 | Update the kernel and reboot. Fixed in 7.2.8-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.8-1 | Update the kernel and reboot. Fixed in 7.2.8-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
mxl862xx_setup() arms the stats poll before mxl862xx_setup_mdio(), and nothing stops it until dsa_register_switch() has returned an error to mxl862xx_probe(). DSA frees the dsa_port list before it returns, so a poll that fires once .setup or a later step of dsa_tree_setup() has failed walks freed ports. On shutdown the user ports stay registered, and the WORK_STOPPED flag test in mxl862xx_get_stats64() is not atomic with the cancel in mxl862xx_shutdown(), so a re-arm that read the flag before it was set queues the poll after cancel_delayed_work_sync() has returned. Arm the poll once .setup has succeeded and stop it from a .teardown op, which DSA calls on unregister and after a failed registration, in both cases before it frees the ports. Use disable_delayed_work_sync() there and in shutdown(): it drains a running poll as the cancel did and turns every later attempt to queue the work into a no-op, so the re-arm cannot bring the poll back. remove() and the probe error path only set WORK_STOPPED, which crc_err_work tests before it walks the ports.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/net/dsa/mxl862xx/mxl862xx.c
- What this is
- MAXLINEAR MXL862XX SWITCH DRIVERMAINTAINERS section matched on drivers/net/dsa/mxl862xx/ · netdev@vger.kernel.org · Maintained
Check it on the machine
grep -wE 'CONFIG_NET_DSA|CONFIG_NET_DSA_MXL862' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian does not build this code in 2 releases. The build rule could not be established for 2 releases, so nothing is claimed about those.
- bookworm, trixie?
- forky, sidn
- ?
- not established - no Makefile entry for the affected file
- n
- not enabled on any flavour - this release does not build the code
Where a release above reads "not established", no build rule for the affected file was found in that release's kernel tree. That is a gap in this lookup, not a finding that the code is absent.
- Build switches
- CONFIG_NET_DSA, CONFIG_NET_DSA_MXL862
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-10-06 (13 days ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.13%, higher than 2.3% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- drivers/net
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 7.1 | 7.2.8 | 97df811a11d4 |
| 7.1 | 7.3 | 9e92ad4630f5 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The racing input is local: reading /proc/net/dev or RTM_GETLINK calls dsa_user_get_stats64() -> mxl862xx_get_stats64(), which re-queues priv->stats_work. No packet from a remote peer feeds the bug; it is a teardown-ordering error in mxl862xx_setup()/remove()/shutdown().
- AC:LAttack complexity, low
- placeholder
- PR:LPrivileges required, low
- Any unprivileged local user can read interface statistics on the switch's user ports, and that read is the attacker's side of the race (the schedule_delayed_work() call in mxl862xx_get_stats64()). No capability check stands in the way.
- UI:NUser interaction, none
- No victim action such as opening a file or mounting media is needed. The attacker's part is only repeated stats reads; the teardown event is covered under AC.
- S:UScope, unchanged
- The freed dsa_port objects and the devm-freed mxl862xx_priv are kernel memory, and the impact stays within the kernel's own security authority.
- C:HConfidentiality impact, high
- mxl862xx_stats_work_fn() walks the ds->ports list after dsa_switch_release_ports() has run kfree(dp). It reads dp->index from freed memory and writes counters into priv->ports[].stats. A use-after-free like this can be turned into a memory read primitive.
- I:HIntegrity impact, high
- On remove, a re-armed stats_work sits inside the devm-freed mxl862xx_priv. When its timer fires, the workqueue uses the work_struct and its func pointer from memory that may have been reallocated, which allows control-flow hijack. The stats poll also writes into freed memory.
- A:HAvailability impact, high
- Walking freed dsa_port entries or running a work item from freed priv memory causes a kernel oops or panic. In the shutdown case, the poll keeps reaching the switch after mxl862xx_host_shutdown(), which can also crash the system during reboot.