CVE-2026-53323
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk5th percentile — higher than 5% of all known CVEs
Summary
A vulnerability in the Linux kernel's DSA (Distributed Switch Architecture) drivers causes a deadlock when running ethtool operations on the conduit (master) interface. The issue stems from redundant netdev_lock_ops calls in DSA wrappers, leading to system hang.
Risk Assessment
A local attacker can trigger a kernel deadlock by executing ethtool commands on a DSA-managed network interface, resulting in a denial of service (DoS) for the entire system.
Recommendation
Immediately update the Linux kernel to a version containing the fix that removes redundant netdev_lock_ops calls in DSA conduit ethtool wrappers.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: net: dsa: remove redundant netdev_lock_ops() from conduit ethtool ops DSA replaces the conduit (master) device's ethtool_ops with its own wrappers that aggregate stats from both the conduit and DSA switch ports. Taking the lock again inside the DSA wrappers causes a deadlock. Stumbled upon this when booting qemu with fbnic and CONFIG_NET_DSA_LOOP=y (which looks like some kind of testing device that auto-populates the ports of eth0). `ethtool -i` is enough to deadlock. This means we have basically zero coverage for DSA stuff with real ops locked devs. Remove the redundant netdev_lock_ops()/netdev_unlock_ops() calls from the DSA conduit ethtool wrappers.