The mxl862xx Data Switch Architecture driver contains a race condition where its statistics polling work item can be scheduled after the driver’s teardown path has freed port objects, producing a use‑after‑free of kernel memory. This flaw can corrupt kernel data structures or allow execution of arbitrary code in kernel mode. Based on the description, it is inferred that an attacker would need to trigger a teardown or a registration failure while the polling work is pending, which typically requires at least local privileged access to the affected system.

Any Linux kernel that includes the unpatched mxl862xx DSA switch driver is affecting. The issue exists in kernel versions that incorporate the driver before the commit that disables the statistics poll on teardown. Affected distributions may vary; administrators should check whether their kernel version predates that change or whether the driver is loaded in a custom build.

EPSS is < 1% and the vulnerability is not listed in CISA KEV, indicating a very low probability of exploitation in the wild. The CVSS score of 7.8 classifies the flaw as high severity, meaning a successful exploitation could cause a use‑after‑free of kernel memory leading to privilege escalation or a kernel panic. Attackers would need local privileged access to trigger a teardown or registration failure while polling work is pending, so the attack vector is inferred to be local with elevated privileges. The high CVSS score underscores the impact on confidentiality, integrity, and availability.