{"schema":"threatline.record/2","record":{"id":"CVE-2026-98305","aliases":[],"summary":"net: dsa: mxl862xx: disable the stats poll on teardown","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: mxl862xx: disable the stats poll on teardown\n\nmxl862xx_setup() arms the stats poll before mxl862xx_setup_mdio(), and\nnothing stops it until dsa_register_switch() has returned an error to\nmxl862xx_probe(). DSA frees the dsa_port list before it returns, so a\npoll that fires once .setup or a later step of dsa_tree_setup() has\nfailed walks freed ports. On shutdown the user ports stay registered,\nand the WORK_STOPPED flag test in mxl862xx_get_stats64() is not atomic\nwith the cancel in mxl862xx_shutdown(), so a re-arm that read the flag\nbefore it was set queues the poll after cancel_delayed_work_sync() has\nreturned.\n\nArm the poll once .setup has succeeded and stop it from a .teardown op,\nwhich DSA calls on unregister and after a failed registration, in both\ncases before it frees the ports. Use disable_delayed_work_sync() there\nand in shutdown(): it drains a running poll as the cancel did and turns\nevery later attempt to queue the work into a no-op, so the re-arm\ncannot bring the poll back. remove() and the probe error path only set\nWORK_STOPPED, which crc_err_work tests before it walks the ports.","categories":["Operating systems"],"product":"Linux","vendor":"Linux","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98305","source_modified_at":"2026-10-19T09:17:16.045Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Linux","vendor":"Linux","versions":[{"version":"a21d33a5265f0b31d935a8b9b2b6faefb5185911","lessThan":"97df811a11d4f76bc2ffe67b6bf730263f56c668","status":"affected","versionType":"git"},{"version":"a21d33a5265f0b31d935a8b9b2b6faefb5185911","lessThan":"9e92ad4630f5dd1838ce6bbe6b1bd2c73d34de36","status":"affected","versionType":"git"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98305","source_modified_at":"2026-10-19T09:17:16.045Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Linux","vendor":"Linux","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","status":"unaffected","versionType":"semver"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}],"defaultStatus":"affected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98305","source_modified_at":"2026-10-19T09:17:16.045Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"97df811a11d4f76bc2ffe67b6bf730263f56c668","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98305","source_modified_at":"2026-10-19T09:17:16.045Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"9e92ad4630f5dd1838ce6bbe6b1bd2c73d34de36","basis":"first unaffected version stated in the CVE record"}],"cvss":7.8,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00129,"percentile":0.02305,"score_date":"2026-10-23"},"published_at":"2026-10-06T08:46:02.190Z","modified_at":"2026-10-19T09:17:16.045Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-98305","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-19T09:17:16.045Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98305","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://git.kernel.org/stable/c/97df811a11d4f76bc2ffe67b6bf730263f56c668"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/9e92ad4630f5dd1838ce6bbe6b1bd2c73d34de36"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-19T09:17:16.045Z","content_hash":"0eed291433db0c9c7f28b97093eaec232bb3f3e36bc449a39c94e4fbfdefca3c"}}