CVE-2026-72411

In the Linux kernel, the following vulnerability has been resolved:

net: dsa: mxl862xx: fix use-after-free of DSA ports in crcerrwork

Upon an MDIO CRC error mxl862xxcrcerrworkfn() walks the DSA ports and closes the CPU port conduits:

dsa_switch_for_each_cpu_port(dp, priv->ds)
    dev_close(dp->conduit);

mxl862xx_remove() unregisters the switch before cancelling this work:

set_bit(MXL862XX_FLAG_WORK_STOPPED, &priv->flags);
cancel_delayed_work_sync(&priv->stats_work);
dsa_unregister_switch(ds);
mxl862xx_host_shutdown(priv);

dsaunregisterswitch() frees the dsa_port objects. If a CRC error schedules the work during teardown it can run after the ports have been freed and dereference freed memory.

Guard the port walk with MXL862XXFLAGWORKSTOPPED, which is already set before dsaunregisterswitch(). DSA tears the ports down under rtnllock(), so checking the flag under rtnllock() means the work either runs before teardown and sees valid ports, or runs afterwards, observes the flag and skips the walk. This mirrors the hostfloodwork handler, which skips torn-down ports under rtnllock().