{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.5-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  net: dsa: mxl862xx: fix use-after-free of DSA ports in crc_err_work  Upon an MDIO CRC error mxl862xx_crc_err_work_fn() walks the DSA ports and closes the CPU port conduits:  \tdsa_switch_for_each_cpu_port(dp, priv-\u003eds) \t\tdev_close(dp-\u003econduit);  mxl862xx_remove() unregisters the switch before cancelling this work:  \tset_bit(MXL862XX_FLAG_WORK_STOPPED, \u0026priv-\u003eflags); \tcancel_delayed_work_sync(\u0026priv-\u003estats_work); \tdsa_unregister_switch(ds); \tmxl862xx_host_shutdown(priv);  dsa_unregister_switch() frees the dsa_port objects. If a CRC error schedules the work during teardown it can run after the ports have been freed and dereference freed memory.  Guard the port walk with MXL862XX_FLAG_WORK_STOPPED, which is already set before dsa_unregister_switch(). DSA tears the ports down under rtnl_lock(), so checking the flag under rtnl_lock() means the work either runs before teardown and sees valid ports, or runs afterwards, observes the flag and skips the walk. This mirrors the host_flood_work handler, which skips torn-down ports under rtnl_lock().",
  "id": "DEBIAN-CVE-2026-72411",
  "modified": "2026-09-14T16:47:41.123124026Z",
  "published": "2026-08-15T06:22:14.720Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-72411"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-72411"
  ]
}