Executive brief
The Linux kernel's Distributed Switch Architecture (DSA) contains a synchronization flaw when handling MAC addresses on VLAN-aware bridges. When a DSA switch is used downstream of a Felix driver, concurrent access to VLAN filtering lists can occur without proper locking, potentially allowing an attacker to cause memory corruption or denial of service through improper data access.
Technical details
The vulnerability is a suspicious RCU (Read-Copy-Update) usage issue in the net/dsa/ subsystem when synchronizing unicast (UC) and multicast (MC) MAC addresses through vlan_for_each(). The root cause is that vlan_for_each() expects rtnl_lock() context, but the DSA slave's ndo_set_rx_mode() call path deliberately avoids holding rtnl_lock() to prevent deadlock scenarios. When the DSA master calls vlan_for_each() from its ndo_set_rx_mode() during VLAN-aware bridge operations, the 8021q driver's VLAN list (vid_list) is accessed without proper synchronization. The attack vector requires network access and involves triggering VLAN bridge configuration. The fix removes the dependency on vlan_for_each() and implements a non-sleepable, rtnl-free alternative using copies of VLAN lists modified from .ndo_vlan_rx_add_vid() and .ndo_vlan_rx_kill_vid() callbacks. Patches are available in the Linux kernel upstream repository.
Affected products
- Linux Linux kernel affected versions through CVE-2023-54149 (specific versions not detailed in advisory)
Timeline
- 2025-12-24: disclosed
- 2025-12-24: advisory: NVD entry published