Linux Kernel CVE-2026-98305

Exploitation requires (1) a system whose kernel is built with the mxl862xx DSA driver AND physical/attached MaxLinear MxL862xx switch hardware present and bound; (2) the ability to drive one of the vulnerable code paths - DSA teardown on unregister, driver shutdown, driver unbind, or a failed dsa_register_switch() during probe - which in practice needs privileged control over the device (e.g. root-level sysfs unbind or module operations); and (3) winning a timing race, because the WORK_STOPPED flag test in mxl862xx_get_stats64() is not atomic with cancel_delayed_work_sync() in shutdown, so the stats poll must re-arm in the narrow window after reading the flag but before/around the cancel. LIMITING factors: no remote vector, no user-interaction path, hardware-specific (config-gated and tied to uncommon switch silicon), and the non-deterministic race window makes reliable triggering difficult. These sharply constrain realistic exploitation despite the 7.8 base score.

This is a use-after-free / race-condition flaw in the Linux kernel DSA driver for MaxLinear MxL862xx Ethernet switches, where a stats-poll delayed work item can run against freed dsa_port structures during failed registration, teardown, or shutdown. The CVSS vector (AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H, score 7.8) frames it as a locally exploitable, high-impact memory-corruption bug, but the signals point to low real-world priority: EPSS is only 0.16% (5th percentile), it is NOT on CISA KEV, and no public exploit code is identified. Exploitation status: no public exploit identified at time of analysis. Two caveats temper the raw CVSS: (1) the root cause is an inherently non-deterministic race (the description repeatedly stresses non-atomic flag checks and re-arm-after-cancel windows), so the vendor's AC:L understates real difficulty - AC:H is more defensible; and (2) the trigger paths (teardown, driver unbind, shutdown, probe failure) normally require privileged control over the device, so PR:L likely understates the true privilege requirement (PR:H). Net: a legitimate memory-safety fix worth patching on affected hardware, but not an urgent, widely-weaponizable threat.

On a device using a MxL862xx DSA switch, a local actor with the ability to unbind/re-bind the switch driver or induce a probe failure triggers teardown while the periodic CRC-error stats poll is still armed; the poll then walks dsa_port structures that DSA has already freed. Winning the narrow race (the WORK_STOPPED test is not atomic with the cancel) corrupts kernel memory, potentially yielding denial of service or privilege escalation. No public proof-of-concept exists, and reliable exploitation requires defeating a timing-dependent window.