SB20261022142 - NULL pointer dereference in Linux kernel net dsa driver

Description

This security bulletin contains information about 1 vulnerability.

1) NULL pointer dereference (CVE-ID: CVE-2026-98564)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by triggering a kernel crash.

The vulnerability exists due to a null pointer dereference in the Linux kernel MT7530 switch driver's interrupt teardown path when handling a late PHY interrupt during switch removal. A local privileged user can exploit interrupt dispatch after the corresponding interrupt mapping has been disposed of to cause handle_nested_irq() to dereference a null interrupt descriptor and crash the kernel.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/0d80ba0a204c6a16bd7778b50de578dff107c0fe
• https://git.kernel.org/stable/c/2357c682f6eaf639dec88c68b3c0c93a3b802635
• https://git.kernel.org/stable/c/f306e465b5a2091cd3fe3dd0feb10cfc94cfb2f8