{"id":"CVE-2026-98565","kind":"vulnerability","aliases":["CVE-2026-98565"],"related":[],"title":"Linux kernel: MT7530 DSA driver crashes on unbind for MT7531 and MT7621","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621\n\nThe core and io supplies are only requested for ID_MT7530: both the\ndevm_regulator_get() in probe and the regulator_enable() in\nmt7530_setup() are guarded by the switch id, but mt7530_remove()\ndisables them unconditionally. On an MT7621 or an MT7531 both pointers\nare still NULL from devm_kzalloc(), so rmmod or a sysfs unbind calls\nregulator_disable() on NULL.","summary":"The Linux kernel's mt7530 network switch driver dereferences a NULL regulator pointer when the device is unbound on MT7531 and MT7621 chips. An attacker with local rights to unbind the driver, or an administrator unloading the module, causes a kernel NULL pointer crash.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","linux-kernel","mediatek-mt7531","mediatek-mt7621","routers","runtime"],"not_affected_if":["driver-never-unbound","no-mt7621-or-mt7531-switch"],"how_to_check":"- Check whether the host uses an MT7621 or MT7531 switch with the mt7530 DSA driver, for example with `lspci` or the device tree.\n- Check the running kernel with `uname -r` and compare it to the fixed stable release in the kernel commit.","fix":"- Update the Linux kernel to a release that includes the mt7530 unbind fix (version unknown from the sources).","status":"open","published_at":"2026-10-18T16:17:08+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:23:19+00:00","updated_at":"2026-10-25T05:23:19+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-25T05:23:19Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the mt7530 unbind fix (version unknown from the sources).","reach":"local","title":"Linux kernel: MT7530 DSA driver crashes on unbind for MT7531 and MT7621","impact":"low","summary":"The Linux kernel's mt7530 network switch driver dereferences a NULL regulator pointer when the device is unbound on MT7531 and MT7621 chips. An attacker with local rights to unbind the driver, or an administrator unloading the module, causes a kernel NULL pointer crash.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","embedded","routers","mediatek-mt7621","mediatek-mt7531"],"confidence":0.7,"needs_auth":"yes","worst_case":"Kernel NULL pointer crash on driver unbind, causing a denial of service","analyst_note":"","how_to_check":"- Check whether the host uses an MT7621 or MT7531 switch with the mt7530 DSA driver, for example with `lspci` or the device tree.\n- Check the running kernel with `uname -r` and compare it to the fixed stable release in the kernel commit.","needs_analyst":false,"not_affected_if":["no-mt7621-or-mt7531-switch","driver-never-unbound"],"who_is_affected":"Only systems with MT7621 or MT7531 switches using the mt7530 DSA driver are affected, such as embedded routers and gateways. The bug triggers when the driver is unbound or the module is removed, so systems that never unload the driver are less exposed. Hosts without these switch chips can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.00064,"input_tokens":3423,"output_tokens":596,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-98565':15A,18A 'administr':65B 'attack':55B 'call':154C 'caus':69B 'chip':53B 'core':98C 'crash':6A,74B 'cve':13A,16A 'derefer':39B,90C 'devic':46B 'devm':110C,146C 'disabl':131C,156C 'driver':5A,38B,62B 'dsa':4A,86C 'embed':19B 'enabl':118C 'fix':88C 'follow':80C 'get':112C 'guard':123C 'id':106C,127C 'io':100C 'kernel':2A,22B,33B,71B,78C 'kzalloc':147C 'linux':1A,21B,32B,77C 'linux-kernel':20B 'local':57B 'mediatek':24B,27B 'mediatek-mt7531':23B 'mediatek-mt7621':26B 'modul':68B 'mt7530':3A,35B,87C,107C,120C,129C 'mt7531':10A,25B,50B,94C,139C 'mt7621':12A,28B,52B,96C,136C 'net':85C 'network':36B 'null':41B,72B,89C,144C,158C 'pointer':43B,73B,141C 'probe':114C 'regul':42B,111C,117C,155C 'remov':130C 'request':104C 'resolv':84C 'right':58B 'rmmod':149C 'router':29B 'runtim':30B 'setup':121C 'still':143C 'suppli':101C 'switch':37B,126C 'sysf':152C 'unbind':8A,60B,92C,153C 'unbound':48B 'uncondit':133C 'unload':66B 'vulner':81C","nicknames":[],"mitigations":[],"who_affected":"Only systems with MT7621 or MT7531 switches using the mt7530 DSA driver are affected, such as embedded routers and gateways. The bug triggers when the driver is unbound or the module is removed, so systems that never unload the driver are less exposed. Hosts without these switch chips can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:08+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98565","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98565","severity":null,"published_at":"2026-10-18T16:17:08+00:00","modified_at":"2026-10-19T10:19:14+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}