CVE-2026-53323 Details
Description
In the Linux kernel, the following vulnerability has been resolved: net: dsa: remove redundant netdev_lock_ops() from conduit ethtool ops DSA replaces the conduit (master) device's ethtool_ops with its own wrappers that aggregate stats from both the conduit and DSA switch ports. Taking the lock again inside the DSA wrappers causes a deadlock. Stumbled upon this when booting qemu with fbnic and CONFIG_NET_DSA_LOOP=y (which looks like some kind of testing device that auto-populates the ports of eth0). `ethtool -i` is enough to deadlock. This means we have basically zero coverage for DSA stuff with real ops locked devs. Remove the redundant netdev_lock_ops()/netdev_unlock_ops() calls from the DSA conduit ethtool wrappers.
A deadlock vulnerability has been identified in the Linux kernel's Ethernet switch architecture (DSA) handling. This issue arises because DSA replaces the conduit device's ethtool operations with its own wrappers, which aggregate statistics from both the conduit and DSA switch ports. The deadlock occurs when the DSA wrappers reintroduce a lock, creating a conflict. This vulnerability was discovered while booting QEMU with a specific testing device that automatically populates network ports, where the 'ethtool -i' command triggered the deadlock. The problem stems from the DSA wrappers locking the operations again, which is unnecessary and causes a deadlock, effectively disrupting the normal operation of DSA with real locked device operations.
The vulnerability has been addressed by removing the redundant locking operations from the DSA conduit ethtool wrappers. Users should update to the latest version of the Linux kernel where this fix has been applied.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/0f99e0c3e19badaf3fdced0d3feba623e59eed41 | kernel.org | Patch |
| https://git.kernel.org/stable/c/74d64ae4254e99ef8c8215b057a76edac82c5f99 | kernel.org | Patch |
| https://git.kernel.org/stable/c/abe91fd045874d21834482adcd7a9693e7377056 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-667 | Improper Locking | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.15, < 6.18.33 >= 6.19, < 7.0.10 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 6, 2026 | Initial Analysis | [email protected] |
| Jun 26, 2026 | New CVE Received | kernel.org |