In the Linux kernel, the following vulnerability has been resolved:

net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621

The core and io supplies are only requested for ID MT7530: both the devm regulator get() in probe and the regulator enable() in mt7530 setup() are guarded by the switch id, but mt7530 remove() disables them unconditionally. On an MT7621 or an MT7531 both pointers are still NULL from devm kzalloc(), so rmmod or a sysfs unbind calls regulator disable() on NULL.