This vulnerability is a use‑after‑free flaw in the Linux kernel’s DSA (Distributed Switch Architecture) driver for MXL862xx devices. When an MDIO CRC error occurs, the work handler walks the list of DSA ports and closes conduit objects. If the switch is being torn down, the driver unregisters the switch and frees the DSA port structures before the work is cancelled. If the CRC error schedules work during this teardown, the work may execute after the ports are freed and dereference released memory, leading to kernel corruption or a crash. The flaw could be exploited to achieve arbitrary code execution in kernel mode or to cause a denial of service by crashing the kernel, although the description does not explicitly state the attacker’s intent.

All Linux kernel builds that include the MXL862xx DSA driver are potentially affected, as vendor information lists only "Linux:Linux" and no specific kernel version is provided. The patch addresses the driver code path for MXL862xx devices, and any kernel deployment that runs that code path without applying the fix would remain vulnerable.

The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, so publicly reported proof of exploitation is not currently known. The risk level is nevertheless high because the flaw results in memory corruption at the kernel level. Exploitation requires a CRC error on the MDIO bus, which could be induced by network traffic or a malicious device attached to the switch. During driver teardown a race condition can trigger the use‑after‑free, so shutdown sequences that occur concurrently with erroneous bus traffic are particularly hazardous. Until the patch is applied, systems cannot guarantee stability or protection against an attacker who can induce CRC errors or force a driver unload while the error handler runs.