{"id":"CVE-2026-98564","kind":"vulnerability","aliases":["CVE-2026-98564"],"related":[],"title":"Linux kernel: MT7530 DSA switch driver can crash on removal","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: mt7530: leave the MDIO IRQ mappings to regmap-irq\n\nmt7530_remove_common() disposes the per-PHY interrupt mappings from\n.remove, but the regmap-irq chip that owns the domain is devm-registered,\nso its parent interrupt is only freed once .remove has returned. The\nswitch's own regmap-irq thread can therefore still dispatch on a mapping\nthat is already gone: irq_find_mapping() returns 0, irq_to_desc() returns\nNULL and handle_nested_irq() locks desc->lock without checking it. The\nattached PHYs have not given those interrupts back yet either, which the\nkernel warns about a moment before the fault.\n\nregmap_del_irq_chip() disposes the same mappings itself, after freeing the\nparent interrupt and before removing the domain, so there is nothing left\nfor the driver to do here. Until it runs the descriptors stay alive, and a\nlate dispatch on one of them is harmless: dsa_unregister_switch() has freed\nthe PHY handlers by then, so handle_nested_irq() finds no action and\nreturns.","summary":"In the Linux kernel's mt7530 DSA switch driver, interrupt mappings for attached PHYs are released too early during device removal, while the switch's interrupt thread can still dispatch on them. The sources describe a kernel fault (NULL descriptor locked) rather than a confirmed remote code execution path.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","infrastructure","linux-kernel","mediatek-switch","routers"],"not_affected_if":["driver-not-loaded","no-mt7530-hardware"],"how_to_check":"- unknown","fix":"- Update to a Linux kernel release that includes the upstream commit 'net: dsa: mt7530: leave the MDIO IRQ mappings to regmap-irq'\n- unknown","status":"open","published_at":"2026-10-18T16:17:08+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:23:20+00:00","updated_at":"2026-10-25T05:23:20+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:23:20Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel release that includes the upstream commit 'net: dsa: mt7530: leave the MDIO IRQ mappings to regmap-irq'\n- unknown","reach":"local","title":"Linux kernel: MT7530 DSA switch driver can crash on removal","impact":"low","summary":"In the Linux kernel's mt7530 DSA switch driver, interrupt mappings for attached PHYs are released too early during device removal, while the switch's interrupt thread can still dispatch on them. The sources describe a kernel fault (NULL descriptor locked) rather than a confirmed remote code execution path.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","embedded","routers","mediatek-switch"],"confidence":0.5,"needs_auth":"unknown","worst_case":"kernel fault on driver removal, possible denial of service","analyst_note":"Check the upstream kernel commit and stable backports for the fixed kernel versions, and whether the fault is reachable without local privileges.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-mt7530-hardware","driver-not-loaded"],"who_is_affected":"Systems running a Linux kernel with the mt7530 DSA driver, typically MediaTek-based managed switches on embedded boards and routers, where the driver can be unbound or removed. Machines without this switch hardware, or without the mt7530 driver loaded, are not affected. The sources do not state a specific fixed kernel version.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000643,"input_tokens":3612,"output_tokens":564,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98564':13A,16A '0':157C 'action':257C 'aliv':230C 'alreadi':151C 'attach':38B,174C 'back':181C 'check':171C 'chip':114C,197C 'code':72B 'common':99C 'confirm':70B 'crash':8A 'cve':11A,14A 'del':195C 'desc':160C,168C 'describ':60B 'descriptor':65B,228C 'devic':45B 'devm':121C 'devm-regist':120C 'dispatch':55B,145C,234C 'dispos':100C,198C 'domain':118C,212C 'driver':6A,34B,220C 'dsa':4A,32B,86C,241C 'earli':43B 'either':183C 'embed':17B 'execut':73B 'fault':63B,193C 'find':154C,255C 'follow':80C 'free':204C 'freed':129C,245C 'given':178C 'gone':152C 'handl':164C,252C 'handler':248C 'harmless':240C 'infrastructur':18B 'interrupt':35B,51B,105C,126C,180C,207C 'irq':91C,96C,113C,140C,153C,158C,166C,196C,254C 'kernel':2A,21B,29B,62B,78C,186C 'late':233C 'leav':88C 'left':217C 'linux':1A,20B,28B,77C 'linux-kernel':19B 'lock':66B,167C,169C 'map':36B,92C,106C,148C,155C,201C 'mdio':90C 'mediatek':23B 'mediatek-switch':22B 'moment':190C 'mt7530':3A,31B,87C,97C 'nest':165C,253C 'net':85C 'noth':216C 'null':64B,162C 'one':236C 'own':116C 'parent':125C,206C 'path':74B 'per':103C 'per-phi':102C 'phi':104C,247C 'phys':39B,175C 'rather':67B 'regist':122C 'regmap':95C,112C,139C,194C 'regmap-irq':94C,111C,138C 'releas':41B 'remot':71B 'remov':10A,46B,98C,108C,131C,210C 'resolv':84C 'return':133C,156C,161C,259C 'router':25B 'run':226C 'sourc':59B 'stay':229C 'still':54B,144C 'switch':5A,24B,33B,49B,135C,243C 'therefor':143C 'thread':52B,141C 'unregist':242C 'vulner':81C 'warn':187C 'without':170C 'yet':182C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the mt7530 DSA driver, typically MediaTek-based managed switches on embedded boards and routers, where the driver can be unbound or removed. Machines without this switch hardware, or without the mt7530 driver loaded, are not affected. The sources do not state a specific fixed kernel version.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:08+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98564","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98564","severity":null,"published_at":"2026-10-18T16:17:08+00:00","modified_at":"2026-10-19T10:19:13+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}