Junglewise Threat Intelligence

CVE-2026-23368: Linux Kernel deadlock in PHY LED trigger registration

CVE-2026-23368 · Severity: medium · CVSS 5.5 · Published 2026-03-25

Technologies: Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Linux, Siemens.

Executive brief

A locking flaw in the Linux kernel's networking component can cause a system deadlock (freeze) when specific network LED triggers are used. This occurs when the system tries to manage network interface lights and internal network status simultaneously, leading to a circular wait for resources. An exploit could result in a complete denial of service, requiring a hard reboot to restore operations.

Technical details

An AB-BA deadlock exists in the Linux kernel when both LEDS_TRIGGER_NETDEV and LED_TRIGGER_PHY are enabled. The issue arises because LED_TRIGGER_PHY registers triggers during 'phy_attach' while holding the RTNL mutex and then attempts to acquire 'triggers_list_lock'. Conversely, LEDS_TRIGGER_NETDEV acquires 'triggers_list_lock' first and then attempts to acquire the RTNL mutex. This circular dependency results in a kernel hang. The fix involves moving 'phy_led_triggers_register' to the 'phy_probe' phase, which does not hold the RTNL mutex, thereby breaking the deadlock condition.

Affected products

  • Linux Linux Kernel versions prior to 2026-03-25 patches
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6

Timeline

  • 2026-03-09: other: Patch authored
  • 2026-03-25: patched: Patches committed to stable trees
  • 2026-03-25: disclosed: CVE published

References

Related threats