In the Linux kernel, the following vulnerability has been resolved: net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621 The core… (CVE-2026-98565)

The vulnerability in the Linux kernel involves the DSA mt7530 driver where the core and IO power supplies are requested only for the device ID_MT7530. The functions devm_regulator_get() and regulator_enable() are conditionally executed based on the device ID, but the cleanup function mt7530_remove() disables these regulators unconditionally. For MT7621 and MT7531 devices, the pointers remain NULL from devm_kzalloc(), leading to a NULL pointer dereference when regulator_disable() is called during module removal or sysfs unbind.

This NULL pointer dereference can cause a kernel crash or denial of service when the affected driver is removed or unbound, potentially impacting system stability on devices using MT7531 or MT7621 with this driver.

A fix has been implemented to guard the disable calls in mt7530_remove() to prevent regulator_disable() from being called on NULL pointers. Users should apply the updated Linux kernel version containing this fix once available. Patch status is not explicitly confirmed in the provided data; check the vendor advisory for current remediation guidance.