Linux dpaa2-switch CVE-2026-98911

Exploitation requires a system running the Linux dpaa2-switch driver, i.e. NXP DPAA2/Layerscape hardware with the DPAA2 Ethernet switch in use - this is the key limiting factor and excludes the vast majority of Linux deployments. The attacker must be on the adjacent network segment (AV:A) and must drive dpaa2_switch_rx() into its error path during frame reception so that the incorrect dpaa2_switch_free_fd() call executes; the available sources do not state exactly what input produces that receive error, and CVSS AC:H indicates triggering it reliably is not straightforward. No authentication or user interaction is required (PR:N/UI:N), but the bug lives only in the Rx error branch, not the default success path.

Signals are consistent and point to a moderate, not urgent, priority. The supplied CVSS is 7.5 (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H): adjacent-network, unauthenticated, no user interaction, but high attack complexity. EPSS is low at 0.21% (11th percentile) and there is no CISA KEV listing and no public exploit reference, so this is exploitation status 'no public exploit identified at time of analysis'. The vuln.today decision label is 'this_week', which aligns with a real-but-not-emergency fix cadence rather than act_now. The dominant caveat is scope of affected code: although tagged generically as 'Linux', the flaw is confined to the NXP DPAA2 Ethernet switch driver (dpaa2-switch), present only on specific NXP Layerscape/DPAA2 hardware, so real-world exposure is far narrower than the 'Linux kernel' label implies. The supplied C:H/I:H/A:H impact is also optimistic: the described defect is an invalid free (the Rx error path wrongly calls dpaa2_switch_free_fd(), which expects a Tx skb pointer in the software-annotation area), whose demonstrable consequence is kernel memory corruption/crash rather than a confirmed confidentiality read primitive. The 'Information Disclosure' tag is inconsistent with this wrong-free mechanism - verify impact classification with the kernel changelog. Net: genuine memory-safety bug worth patching on affected NXP hardware, but AC:H plus niche deployment make widespread opportunistic exploitation unlikely.

An attacker on the Ethernet segment handled by an NXP DPAA2 switch sends traffic that forces an error during frame reception in dpaa2_switch_rx(); the error path incorrectly frees the receive buffer as if it were a transmit skb, calling dev_kfree_skb() on a non-skb (page) pointer and corrupting kernel memory, typically crashing the host. No public exploit code or PoC is identified at time of analysis, and the CVSS AC:H reflects that reliably triggering the error path is non-trivial.