Live › vulnerability › CVE-2026-98565
Go to dashboardThe Linux kernel's mt7530 network switch driver dereferences a NULL regulator pointer when the device is unbound on MT7531 and MT7621 chips. An attacker with local rights to unbind the driver, or an administrator unloading the module, causes a kernel NULL pointer crash.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only systems with MT7621 or MT7531 switches using the mt7530 DSA driver are affected, such as embedded routers and gateways. The bug triggers when the driver is unbound or the module is removed, so systems that never unload the driver are less exposed. Hosts without these switch chips can skip it.
No product ranges from the sources yet.
lspci or the device tree.uname -r and compare it to the fixed stable release in the kernel commit.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621
The core and io supplies are only requested for ID_MT7530: both the devm_regulator_get() in probe and the regulator_enable() in mt7530_setup() are guarded by the switch id, but mt7530_remove() disables them unconditionally. On an MT7621 or an MT7531 both pointers are still NULL from devm_kzalloc(), so rmmod or a sysfs unbind calls regulator_disable() on NULL.
This page as .md · .json · in your agent: get_signal("CVE-2026-98565")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.