Linux Kernel DSA Ethtool Deadlock via Redundant netdev_lock_ops()
CVE-2026-53323 Published on June 26, 2026
net: dsa: remove redundant netdev_lock_ops() from conduit ethtool ops
In the Linux kernel, the following vulnerability has been resolved:
net: dsa: remove redundant netdev_lock_ops() from conduit ethtool ops
DSA replaces the conduit (master) device's ethtool_ops with its own
wrappers that aggregate stats from both the conduit and DSA switch
ports. Taking the lock again inside the DSA wrappers causes a deadlock.
Stumbled upon this when booting qemu with fbnic and CONFIG_NET_DSA_LOOP=y
(which looks like some kind of testing device that auto-populates the ports
of eth0). `ethtool -i` is enough to deadlock. This means we have basically zero
coverage for DSA stuff with real ops locked devs.
Remove the redundant netdev_lock_ops()/netdev_unlock_ops() calls from
the DSA conduit ethtool wrappers.
Products Associated with CVE-2026-53323
stack.watch emails you whenever new vulnerabilities are published in Linux Kernel or Canonical Ubuntu Linux. Just hit a watch button to start following.
Affected Versions
Linux:- Version 2bcf4772e45adb00649a4e9cbff14b08a144f9e3 and below 74d64ae4254e99ef8c8215b057a76edac82c5f99 is affected.
- Version 2bcf4772e45adb00649a4e9cbff14b08a144f9e3 and below abe91fd045874d21834482adcd7a9693e7377056 is affected.
- Version 2bcf4772e45adb00649a4e9cbff14b08a144f9e3 and below 0f99e0c3e19badaf3fdced0d3feba623e59eed41 is affected.
- Version 6.15 is affected.
- Before 6.15 is unaffected.
- Version 6.18.33, <= 6.18.* is unaffected.
- Version 7.0.10, <= 7.0.* is unaffected.
- Version 7.1, <= * is unaffected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.