What is the CVSS score of CVE-2026-72411?

CVE-2026-72411 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-72411?

Network systems deploying MaxLinear MXL862xx Ethernet switches face unpatched privilege escalation risk, with potential for local attackers to gain administrative access through kernel-level…

How to fix or mitigate CVE-2026-72411?

Within 24 hours: identify and inventory all systems using MaxLinear MXL862xx Ethernet switches, document affected kernel versions, and assess their criticality and network exposure. Within 7 days: implement network segmentation and access controls restricting local access to identified systems; review system logs and kernel error logs for indicators of CRC faults in the mxl862xx driver that may signal exploitation attempts. Within 30 days: monitor Linux kernel repositories and MaxLinear security advisories for patch availability; prepare and test remediation plans including kernel updates or driver disablement for non-critical systems; prioritize 14-day remediation for critical infrastructure systems.

Linux Kernel CVE-2026-72411

EUVD-2026-59310 HIGH

2026-08-15 Linux

GHSA-426f-jh2p-2383

Information Disclosure Linux Red Hat Suse

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Race condition requires precise timing of CRC error during teardown window, raising AC to H; AV:L and PR:L are consistent with local authenticated access requirement.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

4.1 MEDIUM

AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 09:11 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

7.8 (HIGH)

CVE Published

Aug 15, 2026 - 05:56 cve.org

HIGH 7.8

CVE Published

Aug 15, 2026 - 05:56 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net: dsa: mxl862xx: fix use-after-free of DSA ports in crc_err_work

Upon an MDIO CRC error mxl862xx_crc_err_work_fn() walks the DSA ports and closes the CPU port conduits:

dsa_switch_for_each_cpu_port(dp, priv->ds) dev_close(dp->conduit);

mxl862xx_remove() unregisters the switch before cancelling this work:

set_bit(MXL862XX_FLAG_WORK_STOPPED, &priv->flags); cancel_delayed_work_sync(&priv->stats_work); dsa_unregister_switch(ds); mxl862xx_host_shutdown(priv);

dsa_unregister_switch() frees the dsa_port objects. If a CRC error schedules the work during teardown it can run after the ports have been freed and dereference freed memory.

Guard the port walk with MXL862XX_FLAG_WORK_STOPPED, which is already set before dsa_unregister_switch(). DSA tears the ports down under rtnl_lock(), so checking the flag under rtnl_lock() means the work either runs before teardown and sees valid ports, or runs afterwards, observes the flag and skips the walk. This mirrors the host_flood_work handler, which skips torn-down ports under rtnl_lock().

AnalysisAI

Use-after-free in the Linux kernel mxl862xx DSA driver exposes systems running MaxLinear MXL862xx Ethernet switches to local privilege escalation via kernel heap corruption. The race condition between the MDIO CRC error work handler and driver teardown allows freed dsa_port objects to be dereferenced if a CRC error is scheduled during the narrow window between MXL862XX_FLAG_WORK_STOPPED being set and dsa_unregister_switch() completing. EPSS is 0.20% (10th percentile) with no CISA KEV listing, reflecting niche hardware dependency and low broad exploitation interest.

Technical ContextAI

The mxl862xx driver manages MaxLinear MXL862xx-series Ethernet switches via the Linux kernel's Distributed Switch Architecture (DSA) subsystem, communicating with switch hardware over MDIO. The flaw resides in the interaction between two asynchronous paths: mxl862xx_crc_err_work_fn(), a delayed work handler scheduled on MDIO CRC errors that iterates dsa_port objects via dsa_switch_for_each_cpu_port to close CPU port conduits, and mxl862xx_remove(), the driver teardown path. The teardown sets MXL862XX_FLAG_WORK_STOPPED and cancels stats_work before calling dsa_unregister_switch(), which frees all dsa_port objects - but the CRC error work is not cancelled before that free, creating a TOCTOU race window. If crc_err_work is scheduled during teardown and executes after port memory is freed, the kernel dereferences invalid heap pointers. The fix gates the port walk on MXL862XX_FLAG_WORK_STOPPED under rtnl_lock(), ensuring the work either sees valid ports or observes the flag and exits, mirroring the existing host_flood_work pattern. CWE is not formally assigned by NVD; the root cause class is CWE-416 (Use-After-Free), inferred from the description.

RemediationAI

Update to Linux kernel 7.1.5 or 7.2-rc1, which incorporate the upstream fix via stable-tree commits cf52622fbc274eb4ca9a2066b258da2ae3dc7406 and bcb3b8314611ed9cb4ff4bff484ef9b154fd1b83 (see https://git.kernel.org/stable/c/cf52622fbc274eb4ca9a2066b258da2ae3dc7406 and https://git.kernel.org/stable/c/bcb3b8314611ed9cb4ff4bff484ef9b154fd1b83). If the mxl862xx driver is not operationally required, blacklisting the module via adding 'blacklist mxl862xx' to /etc/modprobe.d/ eliminates the attack surface entirely at the cost of disabling MXL862xx switch management. Where patching is delayed, restricting local shell access to the affected host to trusted administrators reduces exploitation risk given the PR:L prerequisite. No generic compensating controls are applicable given the kernel-internal, timing-dependent nature of the race.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-72411 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-72411

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code