CVE-2026-72411

A flaw was found in the Linux kernel's mxl862xx Digital Subscriber Line (DSA) driver. An issue during the driver's teardown process, specifically when handling MDIO CRC errors, can lead to a use-after-free vulnerability. This allows the system to attempt to access memory that has already been released, potentially causing system instability or a denial of service.

A moderate-severity use-after-free flaw was found in the Linux kernel's mxl862xx Distributed Switch Architecture (DSA) Ethernet switch driver. When an MDIO CRC error is detected, the driver's delayed work handler mxl862xx_crc_err_work_fn() walks the DSA ports and closes the CPU port conduits. During driver removal, mxl862xx_remove() calls dsa_unregister_switch() before this work is guaranteed to have stopped, and dsa_unregister_switch() frees the dsa_port objects. If a CRC error schedules the work during teardown, the handler can run after the ports have been freed and dereference the freed memory, causing system instability or a denial of service. Red Hat Product Security rated this flaw Moderate, with a CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), because exploitation requires local access and the impact is limited to availability; this differs from the CVEORG score of 7.8, which additionally assigns high confidentiality and integrity impacts. All Red Hat Enterprise Linux and Red Hat In-Vehicle OS products are not affected by this flaw because the vulnerable mxl862xx driver code is not present in the shipped kernel packages.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.