Executive brief
The Linux kernel's LAN743x Ethernet driver was attempting to acquire a spinlock (a synchronization primitive) before properly initializing it during device startup. Systems with kernel debug features enabled would crash during probe. This is a driver initialization bug that could cause boot failures on affected hardware.
Technical details
The vulnerability is a use-of-uninitialized-variable bug in the lan743x_hardware_init() function. During PCI device probe, lan743x_hardware_init() calls pci11x1x_strap_get_status(), which attempts to acquire adapter->eth_syslock_spinlock via lan743x_hs_syslock_acquire(). However, the spinlock was initialized only after the strap status read completed, leaving it in an uninitialized (zeroed) state when first locked. With CONFIG_DEBUG_SPINLOCK enabled, the kernel's spinlock debug checks would detect and fail on the zeroed lock, causing a kernel panic during probe. The fix reorders initialization to call spin_lock_init() before pci11x1x_strap_get_status(). Network access is not required; the bug triggers locally during driver probe on affected LAN743x hardware (Microchip devices like PCI11x1x).
Affected products
- Linux Linux kernel v6.0 and later
Timeline
- 2026-08-15: disclosed: Published to NVD
- 2026-06-30: patched: Upstream patch merged (commit 39139b1c1c2b614096519b526112c726adb12ff0)
- 2026-07-24: patched: Backported to stable kernels