Skip to main content

Linux Kernel CVE-2026-53323

| EUVDEUVD-2026-39858 MEDIUM
Improper Locking (CWE-667)
2026-06-26 Linux GHSA-vg65-jq85-8q85
Information Disclosure Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local trigger via ethtool (PR:L); deadlock causes availability loss (A:H); no confidentiality or integrity impact confirmed by description.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 06, 2026 - 20:49 vuln.today
CVSS changed
Jul 06, 2026 - 20:22 NVD
5.5 (MEDIUM)
Patch available
Jun 26, 2026 - 21:02 EUVD
CVE Published
Jun 26, 2026 - 19:41 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 26, 2026 - 19:41 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

net: dsa: remove redundant netdev_lock_ops() from conduit ethtool ops

DSA replaces the conduit (master) device's ethtool_ops with its own wrappers that aggregate stats from both the conduit and DSA switch ports. Taking the lock again inside the DSA wrappers causes a deadlock.

Stumbled upon this when booting qemu with fbnic and CONFIG_NET_DSA_LOOP=y (which looks like some kind of testing device that auto-populates the ports of eth0). ethtool -i is enough to deadlock. This means we have basically zero coverage for DSA stuff with real ops locked devs.

Remove the redundant netdev_lock_ops()/netdev_unlock_ops() calls from the DSA conduit ethtool wrappers.

AnalysisAI

Deadlock in the Linux kernel's DSA (Distributed Switch Architecture) subsystem allows a local low-privileged user to hang the kernel network stack by running ethtool against a DSA-configured conduit interface. The DSA subsystem replaces the conduit device's ethtool_ops with aggregating wrappers, but these wrappers redundantly invoke netdev_lock_ops() on a lock already held by the kernel ethtool infrastructure, creating a classic double-lock deadlock. No public exploit exists and EPSS sits at 0.15% (5th percentile), though the issue is trivially reproducible with standard system tooling on affected configurations.

Technical ContextAI

Linux DSA (Distributed Switch Architecture, net/dsa) acts as a multiplexer between a 'conduit' (master) Ethernet device and virtual switch ports attached to managed switch ASICs. When ethtool operations are requested, the kernel's ethtool infrastructure acquires the netdev lock via netdev_lock_ops() before dispatching into ethtool_ops callbacks. DSA intercepts this by replacing the conduit's ethtool_ops with its own wrappers that aggregate statistics from both the conduit NIC and attached DSA switch ports. The defect is that these DSA wrappers independently call netdev_lock_ops()/netdev_unlock_ops() themselves, re-acquiring a non-reentrant lock already held by the caller - a textbook CWE-667 (Improper Locking) violation. The issue was surfaced using qemu with fbnic and CONFIG_NET_DSA_LOOP=y, a testing device that auto-populates DSA ports on eth0. CPE identifier: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade to Linux kernel 7.1, 7.0.10, or 6.18.33, which remove the redundant netdev_lock_ops()/netdev_unlock_ops() calls from the DSA conduit ethtool wrappers. Upstream stable fix commits are available at https://git.kernel.org/stable/c/74d64ae4254e99ef8c8215b057a76edac82c5f99, https://git.kernel.org/stable/c/abe91fd045874d21834482adcd7a9693e7377056, and https://git.kernel.org/stable/c/0f99e0c3e19badaf3fdced0d3feba623e59eed41. For systems that cannot immediately patch, disabling DSA kernel modules (CONFIG_NET_DSA and CONFIG_NET_DSA_LOOP) via modprobe blacklisting prevents exploitation entirely, at the cost of losing DSA switch port functionality - acceptable only on hosts where DSA switching is not operationally required. Alternatively, restricting local user access to ethtool via Linux capabilities (e.g., requiring CAP_NET_ADMIN) mitigates the trigger without disabling DSA, but introduces operational friction for legitimate network diagnostics.

Same weakness CWE-667 – Improper Locking

View all
CVE-2025-43510 HIGH POC
7.8
CVE-2019-5886 CRITICAL POC
9.8
CVE-2020-13246 HIGH POC
7.5
CVE-2019-15513 HIGH POC
7.5
CVE-2019-11599 HIGH POC
7.0
CVE-2023-21400 MEDIUM POC
6.7
CVE-2021-20291 MEDIUM POC
6.5
CVE-2026-53049 CRITICAL
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

CVE-2026-53323 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy