CVE-2026-72411 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, network administrators, and users of Linux-based systems should be aware of this vulnerability and take necessary actions to apply the fix. Affected operators should review their Linux kernel versions and apply the official patch or update to the latest version. Vulnerability management and security teams should prioritize this fix and ensure that compensating controls are in place for exposed systems.

Technical summary

The Linux kernel's net: dsa: mxl862xx module is vulnerable to a use-after-free issue. When an MDIO CRC error occurs, the mxl862xx_crc_err_work_fn() function walks DSA ports and closes CPU port conduits. However, if this work is scheduled during teardown, it can run after the ports have been freed, leading to memory dereference. The fix involves guarding the port walk with MXL862XX_FLAG_WORK_STOPPED, which is already set before dsa_unregister_switch(). DSA tears the ports down under rtnl_lock(), so checking the flag under rtnl_lock() means the work either runs before teardown and sees valid ports, or runs afterwards, observes the flag and skips the walk.

Defensive priority

This use-after-free vulnerability in the Linux kernel's net: dsa: mxl862xx module requires immediate attention. A CRC error can trigger a work that walks DSA ports and closes CPU port conduits after the ports have been freed, leading to potential memory dereference.

Recommended defensive actions

• Apply the official patch or update to the latest Linux kernel version
• Review and verify the fix in the Linux kernel source code
• Monitor system logs for potential CRC errors and DSA port issues
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The Linux kernel vulnerability CVE-2026-72411 was resolved by guarding the port walk with MXL862XX_FLAG_WORK_STOPPED. This fix prevents use-after-free of DSA ports in crc_err_work. Evidence is based on official CVE and NVD records, as well as kernel.org references. Affected deployments should verify their Linux kernel versions and apply the official patch or update to the latest version. Defenders should review system logs for potential CRC errors and DSA port issues. Additional verification tasks include reviewing the Linux kernel source code and checking for any related security advisories.

Official resources