Description
In the Linux kernel, the following vulnerability has been resolved:

net: dsa: mt7530: leave the MDIO IRQ mappings to regmap-irq

mt7530_remove_common() disposes the per-PHY interrupt mappings from
.remove, but the regmap-irq chip that owns the domain is devm-registered,
so its parent interrupt is only freed once .remove has returned. The
switch's own regmap-irq thread can therefore still dispatch on a mapping
that is already gone: irq_find_mapping() returns 0, irq_to_desc() returns
NULL and handle_nested_irq() locks desc->lock without checking it. The
attached PHYs have not given those interrupts back yet either, which the
kernel warns about a moment before the fault.

regmap_del_irq_chip() disposes the same mappings itself, after freeing the
parent interrupt and before removing the domain, so there is nothing left
for the driver to do here. Until it runs the descriptors stay alive, and a
late dispatch on one of them is harmless: dsa_unregister_switch() has freed
the PHY handlers by then, so handle_nested_irq() finds no action and
returns.
Published: 2026-10-18
Score: 4.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: No direct impact
Action: Patch
AI Analysis

Impact

The defect resides in the Linux kernel’s mt7530 DSA driver, which handles MDIO IRQ mappings for each PHY device. When a switch is detached, the driver releases per‑PHY interrupt associations while the regmap‑irq chip—owned by the domain’s parent—is still registered. This situation allows the kernel’s interrupt thread to attempt to service an interrupt that has already been unbound. The lookup routines then return empty descriptors; the kernel simply skips processing and returns without a crash or data loss. The condition is therefore a harmless use‑after‑free (CWE‑476).

Affected Systems

Any system running a kernel that includes the mt7530 driver before the upstream patch that eliminates stale MDIO IRQ mappings is vulnerable. The driver is compiled into the mainline kernel, so standard releases lacking this patch are affected. Embedded routers, switches, or custom distributions shipping that kernel version must review the commit history to determine if the fix is present.

Risk and Exploitability

With a CVSS score of 4.1 the vulnerability is low severity, and the EPSS score indicates a very low probability of exploitation. It is not listed in the CISA KEV catalog. An attacker would need a local capability to trigger the removal or disable the switch, but even then the interrupt handling is inert and does not lead to a crash or data corruption. Consequently the overall risk is marginal and primarily a preemptive concern.

Generated by OpenCVE AI on October 22, 2026 at 23:02 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the system to a kernel that incorporates the upstream fix for the mt7530 driver.
  • If a custom or embedded kernel is in use, backport the commit(s) that clear stale MDIO IRQ mappings to the build.
  • After applying the patch or backport, rebuild and deploy the kernel, then reboot or reload the networking stack to ensure the driver is reinitialized.
  • If a patch cannot be applied immediately, consider disabling the mt7530 switch device or its PHY interfaces via sysfs to prevent the removal path that triggers the stale mapping access.

Generated by OpenCVE AI on October 22, 2026 at 23:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Tue, 20 Oct 2026 12:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-476
References
Metrics threat_severity

None

 cvssV3_1

{'score': 4.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Sun, 18 Oct 2026 23:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Sun, 18 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: net: dsa: mt7530: leave the MDIO IRQ mappings to regmap-irq mt7530_remove_common() disposes the per-PHY interrupt mappings from .remove, but the regmap-irq chip that owns the domain is devm-registered, so its parent interrupt is only freed once .remove has returned. The switch's own regmap-irq thread can therefore still dispatch on a mapping that is already gone: irq_find_mapping() returns 0, irq_to_desc() returns NULL and handle_nested_irq() locks desc->lock without checking it. The attached PHYs have not given those interrupts back yet either, which the kernel warns about a moment before the fault. regmap_del_irq_chip() disposes the same mappings itself, after freeing the parent interrupt and before removing the domain, so there is nothing left for the driver to do here. Until it runs the descriptors stay alive, and a late dispatch on one of them is harmless: dsa_unregister_switch() has freed the PHY handlers by then, so handle_nested_irq() finds no action and returns.
Title net: dsa: mt7530: leave the MDIO IRQ mappings to regmap-irq
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-19T09:21:49.010Z

Reserved: 2026-09-25T10:25:14.357Z

Link: CVE-2026-98564

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-18T16:17:08.553

Modified: 2026-10-19T10:19:13.047

Link: CVE-2026-98564

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-18T00:00:00Z

Links: CVE-2026-98564 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T23:15:13Z

Weaknesses