CVE-2026-45907

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-45907", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-13T15:03:33.084Z", "datePublished": "2026-05-27T12:17:20.424Z", "dateUpdated": "2026-05-27T12:17:20.424Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-27T12:17:20.424Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix deadlocks between devlink and netdev instance locks\n\nIn the mentioned \"Fixes\" commit, various work tasks triggering devlink\nhealth reporter recovery were switched to use netdev_trylock to protect\nagainst concurrent tear down of the channels being recovered. But this\nhad the side effect of introducing potential deadlocks because of\nincorrect lock ordering.\n\nThe correct lock order is described by the init flow:\nprobe_one -> mlx5_init_one (acquires devlink lock)\n-> mlx5_init_one_devl_locked -> mlx5_register_device\n-> mlx5_rescan_drivers_locked -...-> mlx5e_probe -> _mlx5e_probe\n-> register_netdev (acquires rtnl lock)\n-> register_netdevice (acquires netdev lock)\n=> devlink lock -> rtnl lock -> netdev lock.\n\nBut in the current recovery flow, the order is wrong:\nmlx5e_tx_err_cqe_work (acquires netdev lock)\n-> mlx5e_reporter_tx_err_cqe -> mlx5e_health_report\n-> devlink_health_report (acquires devlink lock => boom!)\n-> devlink_health_reporter_recover\n-> mlx5e_tx_reporter_recover -> mlx5e_tx_reporter_recover_from_ctx\n-> mlx5e_tx_reporter_err_cqe_recover\n\nThe same pattern exists in:\nmlx5e_reporter_rx_timeout\nmlx5e_reporter_tx_ptpsq_unhealthy\nmlx5e_reporter_tx_timeout\n\nFix these by moving the netdev_trylock calls from the work handlers\nlower in the call stack, in the respective recovery functions, where\nthey are actually necessary."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c", "drivers/net/ethernet/mellanox/mlx5/core/en/reporter_rx.c", "drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c", "drivers/net/ethernet/mellanox/mlx5/core/en_main.c"], "versions": [{"version": "8f7b00307bf14676b7e7f0210110a36aa0ff3e93", "lessThan": "4329514c61abefe4961541b128c549b017bab5ad", "status": "affected", "versionType": "git"}, {"version": "8f7b00307bf14676b7e7f0210110a36aa0ff3e93", "lessThan": "63f9d5fb4d8040077df801ca3270e2f02d55e0d9", "status": "affected", "versionType": "git"}, {"version": "8f7b00307bf14676b7e7f0210110a36aa0ff3e93", "lessThan": "83ac0304a2d77519dae1e54c9713cbe1aedf19c9", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c", "drivers/net/ethernet/mellanox/mlx5/core/en/reporter_rx.c", "drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c", "drivers/net/ethernet/mellanox/mlx5/core/en_main.c"], "versions": [{"version": "6.16", "status": "affected"}, {"version": "0", "lessThan": "6.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.14", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.4", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.18.14"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.19.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/4329514c61abefe4961541b128c549b017bab5ad"}, {"url": "https://git.kernel.org/stable/c/63f9d5fb4d8040077df801ca3270e2f02d55e0d9"}, {"url": "https://git.kernel.org/stable/c/83ac0304a2d77519dae1e54c9713cbe1aedf19c9"}], "title": "net/mlx5e: Fix deadlocks between devlink and netdev instance locks", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c", "drivers/net/ethernet/mellanox/mlx5/core/en/reporter_rx.c", "drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c", "drivers/net/ethernet/mellanox/mlx5/core/en_main.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "4329514c61abefe4961541b128c549b017bab5ad", "status": "affected", "version": "8f7b00307bf14676b7e7f0210110a36aa0ff3e93", "versionType": "git"}, {"lessThan": "63f9d5fb4d8040077df801ca3270e2f02d55e0d9", "status": "affected", "version": "8f7b00307bf14676b7e7f0210110a36aa0ff3e93", "versionType": "git"}, {"lessThan": "83ac0304a2d77519dae1e54c9713cbe1aedf19c9", "status": "affected", "version": "8f7b00307bf14676b7e7f0210110a36aa0ff3e93", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c", "drivers/net/ethernet/mellanox/mlx5/core/en/reporter_rx.c", "drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c", "drivers/net/ethernet/mellanox/mlx5/core/en_main.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"lessThan": "6.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.14", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "974ECCCC-3CBB-4A66-9A34-82621077D7F4", "versionEndExcluding": "6.18.14", "versionStartIncluding": "6.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "672A3E79-EC03-479D-8503-361DFBDC8092", "versionEndExcluding": "6.19.4", "versionStartIncluding": "6.19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix deadlocks between devlink and netdev instance locks\n\nIn the mentioned \"Fixes\" commit, various work tasks triggering devlink\nhealth reporter recovery were switched to use netdev_trylock to protect\nagainst concurrent tear down of the channels being recovered. But this\nhad the side effect of introducing potential deadlocks because of\nincorrect lock ordering.\n\nThe correct lock order is described by the init flow:\nprobe_one -> mlx5_init_one (acquires devlink lock)\n-> mlx5_init_one_devl_locked -> mlx5_register_device\n-> mlx5_rescan_drivers_locked -...-> mlx5e_probe -> _mlx5e_probe\n-> register_netdev (acquires rtnl lock)\n-> register_netdevice (acquires netdev lock)\n=> devlink lock -> rtnl lock -> netdev lock.\n\nBut in the current recovery flow, the order is wrong:\nmlx5e_tx_err_cqe_work (acquires netdev lock)\n-> mlx5e_reporter_tx_err_cqe -> mlx5e_health_report\n-> devlink_health_report (acquires devlink lock => boom!)\n-> devlink_health_reporter_recover\n-> mlx5e_tx_reporter_recover -> mlx5e_tx_reporter_recover_from_ctx\n-> mlx5e_tx_reporter_err_cqe_recover\n\nThe same pattern exists in:\nmlx5e_reporter_rx_timeout\nmlx5e_reporter_tx_ptpsq_unhealthy\nmlx5e_reporter_tx_timeout\n\nFix these by moving the netdev_trylock calls from the work handlers\nlower in the call stack, in the respective recovery functions, where\nthey are actually necessary."}], "id": "CVE-2026-45907", "lastModified": "2026-06-24T16:27:56.443", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-05-27T14:17:05.233", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4329514c61abefe4961541b128c549b017bab5ad"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/63f9d5fb4d8040077df801ca3270e2f02d55e0d9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/83ac0304a2d77519dae1e54c9713cbe1aedf19c9"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Undergoing Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-667"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: net/mlx5e: Fix deadlocks between devlink and netdev instance locks", "id": "2482073", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482073"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-833", "details": ["A flaw was found in the Linux kernel's mlx5e network driver. Incorrect lock ordering between devlink and netdev instance locks can lead to deadlocks. This issue can be triggered during various work tasks related to devlink health reporter recovery or concurrent channel tear down. A local attacker or specific network conditions could potentially exploit this to cause a Denial of Service (DoS) by making the system unresponsive."], "name": "CVE-2026-45907", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-27T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-45907\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-45907\nhttps://lore.kernel.org/linux-cve-announce/2026052721-CVE-2026-45907-2501@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8f7b00307bf14676b7e7f0210110a36aa0ff3e93,4329514c61abefe4961541b128c549b017bab5ad)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8f7b00307bf14676b7e7f0210110a36aa0ff3e93,63f9d5fb4d8040077df801ca3270e2f02d55e0d9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8f7b00307bf14676b7e7f0210110a36aa0ff3e93,83ac0304a2d77519dae1e54c9713cbe1aedf19c9)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.16"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.16)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.14,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.4,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-27T21:15:25.648939+00:00", "updated": "2026-08-12T03:15:04.792107+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}