In the Linux kernel, the following vulnerability has been resolved: net: dsa: mt7530: leave the MDIO IRQ mappings to regmap-irq… (CVE-2026-98564)

The vulnerability in the Linux kernel's mt7530 driver concerns the disposal of per-PHY interrupt mappings during the removal process. The driver disposes these mappings in mt7530_remove_common(), but since the regmap-irq chip is devm-registered, its parent interrupt is freed only after .remove returns. This timing allows the regmap-irq thread to dispatch interrupts on mappings that have been removed, leading to a NULL pointer dereference in handle_nested_irq() due to locking a NULL descriptor. The fix involves leaving the MDIO IRQ mappings management to regmap-irq itself, which properly disposes of the mappings after freeing the parent interrupt, preventing late dispatch faults.

The vulnerability can cause a kernel fault due to a NULL pointer dereference when the regmap-irq thread dispatches on an already removed interrupt mapping. This may lead to instability or crashes in the affected Linux kernel versions running the mt7530 driver. However, the fault occurs after the PHY handlers have been freed, so no further action is taken by handle_nested_irq(), limiting the impact to a potential kernel fault or crash.

A fix has been implemented in the Linux kernel to resolve this issue by delegating the MDIO IRQ mappings management to regmap-irq, which properly frees the parent interrupt and removes the domain in the correct order. Users should update to the fixed Linux kernel version containing this patch. No additional mitigation is required beyond applying the official fix.