Cloudanix VulnDB

CVE-2026-98565

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux network switch driver can crash the whole system when the driver is removed on certain hardware models.

Exploitation
Local Privilege
Attacker needs
High Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

NULL pointer dereference when mt7530_remove unconditionally calls regulator_disable on core and io supplies that remain NULL for MT7531 and MT7621 switches because the allocation and enable paths are guarded by switch ID.

Why it matters to the business

Unloading the DSA driver or unbinding the device on affected switches triggers a kernel crash, causing network loss and requiring a reboot; low EPSS and absence from KEV indicate limited real-world urgency five days after disclosure.

How an attack unfolds

An attacker with local root privileges triggers rmmod of the mt7530 driver or a sysfs unbind operation; the remove handler then passes NULL regulators to regulator_disable, dereferencing the pointer and crashing the kernel.

How to fix it

Apply the upstream fix that guards the regulator_disable calls in mt7530_remove with the same switch-ID checks used elsewhere; rebuild and deploy the patched kernel on all affected systems.

How to confirm the fix worked

Confirm the patched kernel source contains conditional regulator handling around the disable calls in mt7530_remove; verify the driver loads and unloads cleanly on MT7531 and MT7621 hardware without oops.

Typical attack path

  1. Obtain local root access on a system using MT7531 or MT7621 DSA switches
  2. Unload the mt7530 kernel module or write to the unbind sysfs attribute
  3. Trigger unconditional regulator_disable on NULL pointers in mt7530_remove
  4. Cause kernel panic and denial of service

How to detect it

Search kernel logs and dmesg for mt7530 NULL pointer dereference messages triggered during module removal or device unbind; correlate with audit logs showing rmmod or sysfs unbind events on the DSA driver.

What your security team should do

  • Prioritize patching systems that expose the mt7530 driver to unprivileged users
  • Monitor kernel logs for mt7530 NULL dereference oops on module unload
  • Restrict local module unloading via kernel module signing and lockdown mode where feasible
  • Track upstream DSA/mt7530 commits for the exact backport to distribution kernels

The record

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621 The core and io supplies are only requested for ID_MT7530: both the devm_regulator_get() in probe and the regulator_enable() in mt7530_setup() are guarded by the switch id, but mt7530_remove() disables them unconditionally. On an MT7621 or an MT7531 both pointers are still NULL from devm_kzalloc(), so rmmod or a sysfs unbind calls regulator_disable() on NULL.

Affected packages

Ecosystem Package Introduced Fixed