What is CVE-2026-98305?

CVE-2026-98305 is a High severity Linux kernel vulnerability with a CVSS score of 7.8 out of 10, affecting Linux kernel versions from 7.1 onward and patched in 7.2.8 and 7.3-rc4. CVE-2026-98305 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is the CVSS score for CVE-2026-98305?

CVE-2026-98305 has a CVSS score of 7.8 out of 10, rated High severity. The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Is there a patch available for CVE-2026-98305?

Yes, CVE-2026-98305 has been patched. Fixed versions include 7.2.8 and 7.3-rc4. If you are running Linux kernel 7.1 or later up to the fix versions, apply the relevant patch for your kernel branch.

Is CVE-2026-98305 actively exploited?

CVE-2026-98305 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

CVE-2026-98305

High

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mxl862xx: disable the stats poll on teardown mxl862xx_setup() arms the stats poll before mxl862xx_setup_mdio(), and nothing stops it until dsa_register_switch() has returned an error to mxl862xx_probe(). DSA frees the dsa_port list before it returns, so a poll that fires once .setup or a later step of dsa_tree_setup() has failed walks freed ports. On shutdown the user ports stay registered, and the WORK_STOPPED flag test in mxl862xx_get_stats64() is not atomic with the cancel in mxl862xx_shutdown(), so a re-arm that read the flag before it was set queues the poll after cancel_delayed_work_sync() has returned. Arm the poll once .setup has succeeded and stop it from a .teardown op, which DSA calls on unregister and after a failed registration, in both cases before it frees the ports. Use disable_delayed_work_sync() there and in shutdown(): it drains a running poll as the cancel did and turns every later attempt to queue the work into a no-op, so the re-arm cannot bring the poll back. remove() and the probe error path only set WORK_STOPPED, which crc_err_work tests before it walks the ports.

Package Linux Kernel

Published 2026-10-06

Last modified 2026-10-07

CVSS version 3.1

Patch available

Yes

CVSS 3.1 score

7.8

out of 10

High

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected versions

Linux kernel versions 7.1 and later are affected. Fixed in 7.2.8, 7.3-rc4 and their respective stable series.

Affected from

≥ 7.1

Fixed in

✓ 7.2.8 7.2.x ✓ 7.3-rc4

References

2 total

Details

CVE ID CVE-2026-98305

Severity High

CVSS score 7.8 / 10

CVSS version 3.1

Published 2026-10-06

Modified 2026-10-07

KEV No

Patch

Yes

Package linux

Frequently asked questions

What is CVE-2026-98305?

CVE-2026-98305 is a High severity Linux kernel vulnerability with a CVSS score of 7.8 out of 10 . It affects Linux kernel versions from 7.1 onward and has been patched in 7.2.8 and 7.3-rc4. CVE-2026-98305 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
What is the CVSS score for CVE-2026-98305?

CVE-2026-98305 has a CVSS score of 7.8 out of 10, rated High severity (CVSS 3.1). The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Is there a patch available for CVE-2026-98305?

Yes. CVE-2026-98305 has been patched. Fixed versions include 7.2.8 and 7.3-rc4. If you are running Linux kernel 7.1 or later up to the fix versions, apply the relevant patch for your kernel branch.
Is CVE-2026-98305 actively exploited?

No. CVE-2026-98305 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.