Linux Kernel CVE-2026-72109

The sparx5 driver (net/ethernet/microchip/sparx5) implements Linux switchdev functionality for Microchip's Sparx5-family switch ASICs (VSC7558, VSC7552, etc.), used in embedded networking hardware. The driver's initialization function sparx5_register_notifier_blocks() registers three kernel notifier hooks in sequence: a switchdev blocking notifier, a regular switchdev notifier, and a netdevice notifier, followed by allocation of an ordered workqueue via alloc_ordered_workqueue(). The pre-existing error path on workqueue allocation failure correctly unregisters the switchdev and netdevice notifiers but omits unregistering the blocking notifier, leaving it pointing into an incompletely-initialized driver structure. The root cause class is improper error-path cleanup (analogous to CWE-459 Incomplete Cleanup), not explicitly tagged by NVD. When the kernel subsequently delivers a switchdev topology-change notification, the dangling blocking notifier fires into potentially freed or null driver state, producing undefined behavior in kernel context. The fix adds a distinct error label (err_register_netdevice_notifier) to ensure the blocking notifier is unregistered in all failure paths.