Live › vulnerability › CVE-2026-98564
Go to dashboardIn the Linux kernel's mt7530 DSA switch driver, interrupt mappings for attached PHYs are released too early during device removal, while the switch's interrupt thread can still dispatch on them. The sources describe a kernel fault (NULL descriptor locked) rather than a confirmed remote code execution path.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with the mt7530 DSA driver, typically MediaTek-based managed switches on embedded boards and routers, where the driver can be unbound or removed. Machines without this switch hardware, or without the mt7530 driver loaded, are not affected. The sources do not state a specific fixed kernel version.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
net: dsa: mt7530: leave the MDIO IRQ mappings to regmap-irq
mt7530_remove_common() disposes the per-PHY interrupt mappings from .remove, but the regmap-irq chip that owns the domain is devm-registered, so its parent interrupt is only freed once .remove has returned. The switch's own regmap-irq thread can therefore still dispatch on a mapping that is already gone: irq_find_mapping() returns 0, irq_to_desc() returns NULL and handle_nested_irq() locks desc->lock without checking it. The attached PHYs have not given those interrupts back yet either, which the kernel warns about a moment before the fault.
regmap_del_irq_chip() disposes the same mappings itself, after freeing the parent interrupt and before removing the domain, so there is nothing left for the driver to do here. Until it runs the descriptors stay alive, and a late dispatch on one of them is harmless: dsa_unregister_switch() has freed the PHY handlers by then, so handle_nested_irq() finds no action and returns.
This page as .md · .json · in your agent: get_signal("CVE-2026-98564")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.