CVE-2026-98305 in Linux
Summary
by MITRE • 10/06/2026
In the Linux kernel, the following vulnerability has been resolved:
net: dsa: mxl862xx: disable the stats poll on teardown
mxl862xx_setup() arms the stats poll before mxl862xx_setup_mdio(), and nothing stops it until dsa_register_switch() has returned an error to mxl862xx_probe(). DSA frees the dsa_port list before it returns, so a poll that fires once .setup or a later step of dsa_tree_setup() has failed walks freed ports. On shutdown the user ports stay registered, and the WORK_STOPPED flag test in mxl862xx_get_stats64() is not atomic with the cancel in mxl862xx_shutdown(), so a re-arm that read the flag before it was set queues the poll after cancel_delayed_work_sync() has returned.
Arm the poll once .setup has succeeded and stop it from a .teardown op, which DSA calls on unregister and after a failed registration, in both cases before it frees the ports. Use disable_delayed_work_sync() there and in shutdown(): it drains a running poll as the cancel did and turns every later attempt to queue the work into a no-op, so the re-arm cannot bring the poll back. remove() and the probe error path only set WORK_STOPPED, which crc_err_work tests before it walks the ports.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability in question resides within the Linux kernel's Distributed Switch Architecture (DSA) driver for the Marvell 862xx series network switches, specifically affecting the mxl862xx subsystem. This issue manifests as a use-after-free condition triggered by race conditions during device initialization and teardown sequences. The core of the problem lies in the timing of when statistics polling is armed relative to the lifecycle management of switch ports managed by the DSA framework. During the setup phase, the driver arms a delayed work item for stats polling before completing all necessary MDIO configuration steps via mxl862xx_setup_mdio(). If dsa_register_switch() subsequently fails and returns an error code, the DSA core proceeds to free the internal dsa_port list immediately upon returning from that function. However, because the statistics poll was already armed earlier in the sequence, there is a window where a scheduled poll can fire after the port structures have been deallocated but before the driver's cleanup logic has fully neutralized the pending work item. This results in the kernel attempting to access memory associated with freed ports, leading to potential data corruption or system instability.
The operational impact of this vulnerability extends beyond simple initialization failures and also affects normal shutdown procedures due to a lack of atomicity in flag management. During device removal or shutdown, the driver sets a WORK_STOPPED flag to indicate that polling should cease. However, the check for this flag within mxl862xx_get_stats64() is not performed atomically with respect to the cancel operation executed in mxl862xx_shutdown(). This creates a classic time-of-check-to-time-of-use (TOCTOU) race condition. A re-arm of the work queue might read the WORK_STOPPED flag before it has been set by the shutdown routine, subsequently queuing the poll after cancel_delayed_work_sync() has already returned. Consequently, even during normal operation or graceful shutdown, a statistics poll can be scheduled to execute on stale or freed memory structures if the timing aligns unfavorably with the cancellation process. This undermines system reliability and poses a risk of kernel panics or undefined behavior under specific load conditions where rapid device removal and re-initialization occur.
From a vulnerability classification perspective, this flaw is best categorized as CWE-416: Use After Free, compounded by CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition). The root cause is the improper ordering of resource allocation and deallocation relative to asynchronous task scheduling. In terms of offensive security frameworks such as MITRE ATT&CK, this vulnerability could potentially be leveraged for privilege escalation or denial-of-service attacks if an attacker can trigger the specific race condition through repeated device unbinding and rebinding operations, although exploitation typically requires local access with sufficient privileges to manipulate network interfaces. The lack of synchronization primitives around the state flag further exacerbates the risk, allowing concurrent threads to observe inconsistent states regarding whether the polling mechanism is active or terminated.
To mitigate this vulnerability, the driver implementation has been updated to enforce stricter lifecycle management for the statistics poll work item. The arm operation for the stats poll has been moved to occur only after mxl862xx_setup() has successfully completed and dsa_register_switch() has returned without error. This ensures that no asynchronous tasks are pending against resources that might be freed during a failed initialization sequence. Furthermore, the stop mechanism has been relocated to the .teardown operation within the DSA framework, which is invoked both on successful unregister and after a failed registration attempt, ensuring it executes before any port structures are released by the core. The implementation now utilizes disable_delayed_work_sync() in both the teardown path and the shutdown routine. This function not only cancels pending work but also drains any currently executing instance of the worker, preventing re-entry. By combining this with a non-atomic check for WORK_STOPPED that is protected against race conditions through proper synchronization or by relying on the guarantees provided by disable_delayed_work_sync(), the driver ensures that no new polls can be queued after cancellation has been initiated. This structural change aligns the driver's behavior with best practices for kernel device drivers, ensuring robustness against initialization failures and shutdown races.