Skip to main content

Linux Kernel CVE-2026-53231

| EUVDEUVD-2026-39322 MEDIUM
Improper Locking (CWE-667)
2026-06-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-cmgx-qw5m-5j29
Information Disclosure Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local trigger via low-privilege interface manipulation; pure availability impact through deadlock; no confidentiality or integrity effect.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
4.7 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 02, 2026 - 20:53 vuln.today
CVSS changed
Jul 02, 2026 - 20:52 NVD
5.5 (MEDIUM)
Patch available
Jun 25, 2026 - 10:32 EUVD
CVE Published
Jun 25, 2026 - 09:16 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 25, 2026 - 09:16 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

net: phy: don't try to setup PHY-driven SFP cages when using genphy

We don't have support for PHY-driver SFP cages with the genphy code.

On top of that, it was found by sashiko that running sfp_bus_add_upstream() for genphy deadlocks, as for genphy the PHY probing runs under RTNL, which isn't the case for non-genphy drivers.

This problem was reproduced, and does lead to a deadlock on RTNL.

Before the blamed commit, the phy_sfp_probe() call was made by individual PHY drivers, so there was no way to get to the SFP probing path when using genphy.

Let's therefore only run phy_sfp_probe when not using genphy.

AnalysisAI

Deadlock in the Linux kernel PHY networking subsystem (net/phy) allows a local low-privileged user to freeze the networking stack on systems using the generic PHY driver (genphy) with SFP cage hardware. When genphy triggers PHY probing - which occurs while holding the RTNL lock - it erroneously calls sfp_bus_add_upstream(), which itself attempts to acquire RTNL, producing a self-deadlock confirmed by reproduction. No public exploit exists and EPSS is 0.16% (6th percentile), reflecting that exploitation requires an uncommon hardware and driver combination.

Technical ContextAI

The flaw resides in the Linux kernel's net/phy subsystem, specifically in the code path that calls phy_sfp_probe() during PHY initialization. The generic PHY driver (genphy) is used when no vendor-specific PHY driver is available for a network interface. Unlike vendor drivers, genphy performs PHY probing while holding the RTNL (Route Netlink) lock - a global kernel lock governing network interface state. A prior commit introduced a blanket call to phy_sfp_probe() (which invokes sfp_bus_add_upstream()) from the genphy path, but sfp_bus_add_upstream() also tries to acquire RTNL, creating a classic self-deadlock classified under CWE-667 (Improper Locking). Before the blamed commit (bad869b5e41a08424ff130fd6bb41b854be70095), phy_sfp_probe() was only reachable from vendor PHY drivers that do not hold RTNL during probing. CPE data confirms the affected product as cpe:2.3:o:linux:linux_kernel:*. SFP (Small Form-factor Pluggable) interfaces are optical/copper transceiver slots common in managed networking hardware.

RemediationAI

The primary fix is to upgrade the Linux kernel to version 7.0.13 (stable branch) or 7.1 (mainline). Upstream fix commits are available at https://git.kernel.org/stable/c/5a0082ec20a05ef2378410323a5089a8f1786f4a (stable) and https://git.kernel.org/stable/c/ef8d739eee6f85303cbecebc01eb72f063de74e0 (mainline). Distribution vendors are expected to backport these commits to their supported kernel branches; consult your distribution's errata for specific package versions. If immediate patching is not feasible, a targeted compensating control is to ensure that network interfaces using the genphy driver and SFP hardware are not brought online on affected systems - for example, by blacklisting the relevant module or suppressing interface initialization at boot - though this directly impairs network functionality. There is no software workaround that eliminates the deadlock risk without applying the kernel fix.

Same weakness CWE-667 – Improper Locking

View all
CVE-2025-43510 HIGH POC
7.8
CVE-2019-5886 CRITICAL POC
9.8
CVE-2020-13246 HIGH POC
7.5
CVE-2019-15513 HIGH POC
7.5
CVE-2019-11599 HIGH POC
7.0
CVE-2023-21400 MEDIUM POC
6.7
CVE-2021-20291 MEDIUM POC
6.5
CVE-2026-53049 CRITICAL
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

CVE-2026-53231 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy