Executive brief
A flaw in the Linux kernel's Mellanox network driver can cause a system deadlock when changing network switch modes. This occurs because two internal processes try to lock the same resource simultaneously, leading to a complete freeze of the affected network component. This could allow a local user to cause a denial-of-service condition, impacting system availability and network operations.
Technical details
A deadlock exists in the net/mlx5 driver of the Linux kernel due to improper locking order between the devlink lock and the eswitch workqueue (esw->wq). Specifically, the work handler 'esw_vfs_changed_event_handler' acquires the devlink lock, while '.eswitch_mode_set' (which already holds the devlink lock) calls 'flush_workqueue', creating a circular dependency. An attacker with local access could trigger this deadlock by initiating eswitch mode changes. The fix involves removing the workqueue flush and implementing a generation counter to ensure work items are still relevant when processed. Patches have been released for multiple stable kernel branches including 6.1, 6.6, 6.12, 6.18, and 6.19.
Affected products
- Linux Linux Kernel 6.0 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.78, 6.13 to 6.18.19, 6.19 to 6.19.9, 7.0-rc1 to 7.0-rc3
Timeline
- 2026-03-05: patched: Initial patch submitted by NVIDIA
- 2026-05-08: disclosed: CVE-2026-43468 published
References
- https://git.kernel.org/stable/c/0de867f6e34eae6907b367fd152c55e61cb98608
- https://git.kernel.org/stable/c/3c7313cb41b1b427078440364d2f042c276a1c0b
- https://git.kernel.org/stable/c/4a7838bebc38374f74baaf88bf2cf8d439a92923
- https://git.kernel.org/stable/c/90e7e5d14d0bd25ffd019a3aa39d9f1c05fedbe1
- https://git.kernel.org/stable/c/957d2a58f7f8ebcbdd0a85935e0d2675134b890d
- https://git.kernel.org/stable/c/aed763abf0e905b4b8d747d1ba9e172961572f57