GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-23368 (GCVE-0-2026-23368)

Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-09-08 08:45
VLAI
Title
net: phy: register phy led_triggers during probe to avoid AB-BA deadlock
Summary
In the Linux kernel, the following vulnerability has been resolved: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock There is an AB-BA deadlock when both LEDS_TRIGGER_NETDEV and LED_TRIGGER_PHY are enabled: [ 1362.049207] [<8054e4b8>] led_trigger_register+0x5c/0x1fc <-- Trying to get lock "triggers_list_lock" via down_write(&triggers_list_lock); [ 1362.054536] [<80662830>] phy_led_triggers_register+0xd0/0x234 [ 1362.060329] [<8065e200>] phy_attach_direct+0x33c/0x40c [ 1362.065489] [<80651fc4>] phylink_fwnode_phy_connect+0x15c/0x23c [ 1362.071480] [<8066ee18>] mtk_open+0x7c/0xba0 [ 1362.075849] [<806d714c>] __dev_open+0x280/0x2b0 [ 1362.080384] [<806d7668>] __dev_change_flags+0x244/0x24c [ 1362.085598] [<806d7698>] dev_change_flags+0x28/0x78 [ 1362.090528] [<807150e4>] dev_ioctl+0x4c0/0x654 <-- Hold lock "rtnl_mutex" by calling rtnl_lock(); [ 1362.094985] [<80694360>] sock_ioctl+0x2f4/0x4e0 [ 1362.099567] [<802e9c4c>] sys_ioctl+0x32c/0xd8c [ 1362.104022] [<80014504>] syscall_common+0x34/0x58 Here LED_TRIGGER_PHY is registering LED triggers during phy_attach while holding RTNL and then taking triggers_list_lock. [ 1362.191101] [<806c2640>] register_netdevice_notifier+0x60/0x168 <-- Trying to get lock "rtnl_mutex" via rtnl_lock(); [ 1362.197073] [<805504ac>] netdev_trig_activate+0x194/0x1e4 [ 1362.202490] [<8054e28c>] led_trigger_set+0x1d4/0x360 <-- Hold lock "triggers_list_lock" by down_read(&triggers_list_lock); [ 1362.207511] [<8054eb38>] led_trigger_write+0xd8/0x14c [ 1362.212566] [<80381d98>] sysfs_kf_bin_write+0x80/0xbc [ 1362.217688] [<8037fcd8>] kernfs_fop_write_iter+0x17c/0x28c [ 1362.223174] [<802cbd70>] vfs_write+0x21c/0x3c4 [ 1362.227712] [<802cc0c4>] ksys_write+0x78/0x12c [ 1362.232164] [<80014504>] syscall_common+0x34/0x58 Here LEDS_TRIGGER_NETDEV is being enabled on an LED. It first takes triggers_list_lock and then RTNL. A classical AB-BA deadlock. phy_led_triggers_registers() does not require the RTNL, it does not make any calls into the network stack which require protection. There is also no requirement the PHY has been attached to a MAC, the triggers only make use of phydev state. This allows the call to phy_led_triggers_registers() to be placed elsewhere. PHY probe() and release() don't hold RTNL, so solving the AB-BA deadlock.
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 06f502f57d0d7728f9fa0f157ec5e4111ddb98f6 , < 2b01518eabace18f7ec8b4cafd52082303080dca (git)
Affected: 06f502f57d0d7728f9fa0f157ec5e4111ddb98f6 , < 305afdd02ff3e694c165457793104710ec0728e5 (git)
Affected: 06f502f57d0d7728f9fa0f157ec5e4111ddb98f6 , < c6ffc2d2338d325e1edd0c702e3ee623aa5fdc6a (git)
Affected: 06f502f57d0d7728f9fa0f157ec5e4111ddb98f6 , < c33523b8fd2d4c504ada18cd93f511f2a8f84217 (git)
Affected: 06f502f57d0d7728f9fa0f157ec5e4111ddb98f6 , < 241cd64cf2e32b28ead151b1795cd8fef2b6e482 (git)
Affected: 06f502f57d0d7728f9fa0f157ec5e4111ddb98f6 , < 2764dcb3c35de4410f642afc62cf979727470575 (git)
Affected: 06f502f57d0d7728f9fa0f157ec5e4111ddb98f6 , < cde2d0b5ab5d03b5b6f17d4f654d8b30ccf36757 (git)
Affected: 06f502f57d0d7728f9fa0f157ec5e4111ddb98f6 , < c8dbdc6e380e7e96a51706db3e4b7870d8a9402d (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.16
Unaffected: 0 , < 4.16 (semver)
Unaffected: 5.10.253 , ≤ 5.10.* (semver)
Unaffected: 5.15.203 , ≤ 5.15.* (semver)
Unaffected: 6.1.167 , ≤ 6.1.* (semver)
Unaffected: 6.6.130 , ≤ 6.6.* (semver)
Unaffected: 6.12.78 , ≤ 6.12.* (semver)
Unaffected: 6.18.17 , ≤ 6.18.* (semver)
Unaffected: 6.19.7 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP Affected: V3.1.6 , < * (custom)
guessed Create a notification for this product.
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP Affected: V3.1.5 , < * (custom)
guessed Create a notification for this product.
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP Affected: V3.1.6 , < * (custom)
guessed Create a notification for this product.
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP Affected: V3.1.5 , < * (custom)
guessed Create a notification for this product.
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP Affected: V3.1.6 , < * (custom)
guessed Create a notification for this product.
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP Affected: V3.1.5 , < * (custom)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T08:45:47.019Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/phy/phy_device.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2b01518eabace18f7ec8b4cafd52082303080dca",
              "status": "affected",
              "version": "06f502f57d0d7728f9fa0f157ec5e4111ddb98f6",
              "versionType": "git"
            },
            {
              "lessThan": "305afdd02ff3e694c165457793104710ec0728e5",
              "status": "affected",
              "version": "06f502f57d0d7728f9fa0f157ec5e4111ddb98f6",
              "versionType": "git"
            },
            {
              "lessThan": "c6ffc2d2338d325e1edd0c702e3ee623aa5fdc6a",
              "status": "affected",
              "version": "06f502f57d0d7728f9fa0f157ec5e4111ddb98f6",
              "versionType": "git"
            },
            {
              "lessThan": "c33523b8fd2d4c504ada18cd93f511f2a8f84217",
              "status": "affected",
              "version": "06f502f57d0d7728f9fa0f157ec5e4111ddb98f6",
              "versionType": "git"
            },
            {
              "lessThan": "241cd64cf2e32b28ead151b1795cd8fef2b6e482",
              "status": "affected",
              "version": "06f502f57d0d7728f9fa0f157ec5e4111ddb98f6",
              "versionType": "git"
            },
            {
              "lessThan": "2764dcb3c35de4410f642afc62cf979727470575",
              "status": "affected",
              "version": "06f502f57d0d7728f9fa0f157ec5e4111ddb98f6",
              "versionType": "git"
            },
            {
              "lessThan": "cde2d0b5ab5d03b5b6f17d4f654d8b30ccf36757",
              "status": "affected",
              "version": "06f502f57d0d7728f9fa0f157ec5e4111ddb98f6",
              "versionType": "git"
            },
            {
              "lessThan": "c8dbdc6e380e7e96a51706db3e4b7870d8a9402d",
              "status": "affected",
              "version": "06f502f57d0d7728f9fa0f157ec5e4111ddb98f6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/phy/phy_device.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.16"
            },
            {
              "lessThan": "4.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.253",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.78",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.17",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.253",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.167",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.130",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.78",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.17",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.7",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: phy: register phy led_triggers during probe to avoid AB-BA deadlock\n\nThere is an AB-BA deadlock when both LEDS_TRIGGER_NETDEV and\nLED_TRIGGER_PHY are enabled:\n\n[ 1362.049207] [\u003c8054e4b8\u003e] led_trigger_register+0x5c/0x1fc             \u003c-- Trying to get lock \"triggers_list_lock\" via down_write(\u0026triggers_list_lock);\n[ 1362.054536] [\u003c80662830\u003e] phy_led_triggers_register+0xd0/0x234\n[ 1362.060329] [\u003c8065e200\u003e] phy_attach_direct+0x33c/0x40c\n[ 1362.065489] [\u003c80651fc4\u003e] phylink_fwnode_phy_connect+0x15c/0x23c\n[ 1362.071480] [\u003c8066ee18\u003e] mtk_open+0x7c/0xba0\n[ 1362.075849] [\u003c806d714c\u003e] __dev_open+0x280/0x2b0\n[ 1362.080384] [\u003c806d7668\u003e] __dev_change_flags+0x244/0x24c\n[ 1362.085598] [\u003c806d7698\u003e] dev_change_flags+0x28/0x78\n[ 1362.090528] [\u003c807150e4\u003e] dev_ioctl+0x4c0/0x654                       \u003c-- Hold lock \"rtnl_mutex\" by calling rtnl_lock();\n[ 1362.094985] [\u003c80694360\u003e] sock_ioctl+0x2f4/0x4e0\n[ 1362.099567] [\u003c802e9c4c\u003e] sys_ioctl+0x32c/0xd8c\n[ 1362.104022] [\u003c80014504\u003e] syscall_common+0x34/0x58\n\nHere LED_TRIGGER_PHY is registering LED triggers during phy_attach\nwhile holding RTNL and then taking triggers_list_lock.\n\n[ 1362.191101] [\u003c806c2640\u003e] register_netdevice_notifier+0x60/0x168      \u003c-- Trying to get lock \"rtnl_mutex\" via rtnl_lock();\n[ 1362.197073] [\u003c805504ac\u003e] netdev_trig_activate+0x194/0x1e4\n[ 1362.202490] [\u003c8054e28c\u003e] led_trigger_set+0x1d4/0x360                 \u003c-- Hold lock \"triggers_list_lock\" by down_read(\u0026triggers_list_lock);\n[ 1362.207511] [\u003c8054eb38\u003e] led_trigger_write+0xd8/0x14c\n[ 1362.212566] [\u003c80381d98\u003e] sysfs_kf_bin_write+0x80/0xbc\n[ 1362.217688] [\u003c8037fcd8\u003e] kernfs_fop_write_iter+0x17c/0x28c\n[ 1362.223174] [\u003c802cbd70\u003e] vfs_write+0x21c/0x3c4\n[ 1362.227712] [\u003c802cc0c4\u003e] ksys_write+0x78/0x12c\n[ 1362.232164] [\u003c80014504\u003e] syscall_common+0x34/0x58\n\nHere LEDS_TRIGGER_NETDEV is being enabled on an LED. It first takes\ntriggers_list_lock and then RTNL. A classical AB-BA deadlock.\n\nphy_led_triggers_registers() does not require the RTNL, it does not\nmake any calls into the network stack which require protection. There\nis also no requirement the PHY has been attached to a MAC, the\ntriggers only make use of phydev state. This allows the call to\nphy_led_triggers_registers() to be placed elsewhere. PHY probe() and\nrelease() don\u0027t hold RTNL, so solving the AB-BA deadlock."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:05:31.385Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2b01518eabace18f7ec8b4cafd52082303080dca"
        },
        {
          "url": "https://git.kernel.org/stable/c/305afdd02ff3e694c165457793104710ec0728e5"
        },
        {
          "url": "https://git.kernel.org/stable/c/c6ffc2d2338d325e1edd0c702e3ee623aa5fdc6a"
        },
        {
          "url": "https://git.kernel.org/stable/c/c33523b8fd2d4c504ada18cd93f511f2a8f84217"
        },
        {
          "url": "https://git.kernel.org/stable/c/241cd64cf2e32b28ead151b1795cd8fef2b6e482"
        },
        {
          "url": "https://git.kernel.org/stable/c/2764dcb3c35de4410f642afc62cf979727470575"
        },
        {
          "url": "https://git.kernel.org/stable/c/cde2d0b5ab5d03b5b6f17d4f654d8b30ccf36757"
        },
        {
          "url": "https://git.kernel.org/stable/c/c8dbdc6e380e7e96a51706db3e4b7870d8a9402d"
        }
      ],
      "title": "net: phy: register phy led_triggers during probe to avoid AB-BA deadlock",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23368",
    "datePublished": "2026-03-25T10:27:49.889Z",
    "dateReserved": "2026-01-13T15:37:46.003Z",
    "dateUpdated": "2026-09-08T08:45:47.019Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-23368",
      "date": "2026-09-16",
      "epss": "0.00099",
      "percentile": "0.00933"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-23368\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-03-25T11:16:36.167\",\"lastModified\":\"2026-07-14T13:18:31.190\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: phy: register phy led_triggers during probe to avoid AB-BA deadlock\\n\\nThere is an AB-BA deadlock when both LEDS_TRIGGER_NETDEV and\\nLED_TRIGGER_PHY are enabled:\\n\\n[ 1362.049207] [\u003c8054e4b8\u003e] led_trigger_register+0x5c/0x1fc             \u003c-- Trying to get lock \\\"triggers_list_lock\\\" via down_write(\u0026triggers_list_lock);\\n[ 1362.054536] [\u003c80662830\u003e] phy_led_triggers_register+0xd0/0x234\\n[ 1362.060329] [\u003c8065e200\u003e] phy_attach_direct+0x33c/0x40c\\n[ 1362.065489] [\u003c80651fc4\u003e] phylink_fwnode_phy_connect+0x15c/0x23c\\n[ 1362.071480] [\u003c8066ee18\u003e] mtk_open+0x7c/0xba0\\n[ 1362.075849] [\u003c806d714c\u003e] __dev_open+0x280/0x2b0\\n[ 1362.080384] [\u003c806d7668\u003e] __dev_change_flags+0x244/0x24c\\n[ 1362.085598] [\u003c806d7698\u003e] dev_change_flags+0x28/0x78\\n[ 1362.090528] [\u003c807150e4\u003e] dev_ioctl+0x4c0/0x654                       \u003c-- Hold lock \\\"rtnl_mutex\\\" by calling rtnl_lock();\\n[ 1362.094985] [\u003c80694360\u003e] sock_ioctl+0x2f4/0x4e0\\n[ 1362.099567] [\u003c802e9c4c\u003e] sys_ioctl+0x32c/0xd8c\\n[ 1362.104022] [\u003c80014504\u003e] syscall_common+0x34/0x58\\n\\nHere LED_TRIGGER_PHY is registering LED triggers during phy_attach\\nwhile holding RTNL and then taking triggers_list_lock.\\n\\n[ 1362.191101] [\u003c806c2640\u003e] register_netdevice_notifier+0x60/0x168      \u003c-- Trying to get lock \\\"rtnl_mutex\\\" via rtnl_lock();\\n[ 1362.197073] [\u003c805504ac\u003e] netdev_trig_activate+0x194/0x1e4\\n[ 1362.202490] [\u003c8054e28c\u003e] led_trigger_set+0x1d4/0x360                 \u003c-- Hold lock \\\"triggers_list_lock\\\" by down_read(\u0026triggers_list_lock);\\n[ 1362.207511] [\u003c8054eb38\u003e] led_trigger_write+0xd8/0x14c\\n[ 1362.212566] [\u003c80381d98\u003e] sysfs_kf_bin_write+0x80/0xbc\\n[ 1362.217688] [\u003c8037fcd8\u003e] kernfs_fop_write_iter+0x17c/0x28c\\n[ 1362.223174] [\u003c802cbd70\u003e] vfs_write+0x21c/0x3c4\\n[ 1362.227712] [\u003c802cc0c4\u003e] ksys_write+0x78/0x12c\\n[ 1362.232164] [\u003c80014504\u003e] syscall_common+0x34/0x58\\n\\nHere LEDS_TRIGGER_NETDEV is being enabled on an LED. It first takes\\ntriggers_list_lock and then RTNL. A classical AB-BA deadlock.\\n\\nphy_led_triggers_registers() does not require the RTNL, it does not\\nmake any calls into the network stack which require protection. There\\nis also no requirement the PHY has been attached to a MAC, the\\ntriggers only make use of phydev state. This allows the call to\\nphy_led_triggers_registers() to be placed elsewhere. PHY probe() and\\nrelease() don\u0027t hold RTNL, so solving the AB-BA deadlock.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:\\n\\nnet: phy: registrar los led_triggers del phy durante la sonda para evitar un interbloqueo AB-BA\\n\\nExiste un interbloqueo AB-BA cuando tanto LEDS_TRIGGER_NETDEV como LED_TRIGGER_PHY est\u00e1n habilitados:\\n\\n[ 1362.049207] [\u0026lt;8054e4b8\u0026gt;] led_trigger_register+0x5c/0x1fc \u0026lt;-- Intentando obtener el bloqueo \u0027triggers_list_lock\u0027 a trav\u00e9s de down_write(\u0026amp;triggers_list_lock);\\n[ 1362.054536] [\u0026lt;80662830\u0026gt;] phy_led_triggers_register+0xd0/0x234\\n[ 1362.060329] [\u0026lt;8065e200\u0026gt;] phy_attach_direct+0x33c/0x40c\\n[ 1362.065489] [\u0026lt;80651fc4\u0026gt;] phylink_fwnode_phy_connect+0x15c/0x23c\\n[ 1362.071480] [\u0026lt;8066ee18\u0026gt;] mtk_open+0x7c/0xba0\\n[ 1362.075849] [\u0026lt;806d714c\u0026gt;] __dev_open+0x280/0x2b0\\n[ 1362.080384] [\u0026lt;806d7668\u0026gt;] __dev_change_flags+0x244/0x24c\\n[ 1362.085598] [\u0026lt;806d7698\u0026gt;] dev_change_flags+0x28/0x78\\n[ 1362.090528] [\u0026lt;807150e4\u0026gt;] dev_ioctl+0x4c0/0x654 \u0026lt;-- Mantiene el bloqueo \u0027rtnl_mutex\u0027 al llamar a rtnl_lock();\\n[ 1362.094985] [\u0026lt;80694360\u0026gt;] sock_ioctl+0x2f4/0x4e0\\n[ 1362.099567] [\u0026lt;802e9c4c\u0026gt;] sys_ioctl+0x32c/0xd8c\\n[ 1362.104022] [\u0026lt;80014504\u0026gt;] syscall_common+0x34/0x58\\n\\nAqu\u00ed LED_TRIGGER_PHY est\u00e1 registrando los disparadores LED durante phy_attach mientras mantiene RTNL y luego toma triggers_list_lock.\\n\\n[ 1362.191101] [\u0026lt;806c2640\u0026gt;] register_netdevice_notifier+0x60/0x168 \u0026lt;-- Intentando obtener el bloqueo \u0027rtnl_mutex\u0027 a trav\u00e9s de rtnl_lock();\\n[ 1362.197073] [\u0026lt;805504ac\u0026gt;] netdev_trig_activate+0x194/0x1e4\\n[ 1362.202490] [\u0026lt;8054e28c\u0026gt;] led_trigger_set+0x1d4/0x360 \u0026lt;-- Mantiene el bloqueo \u0027triggers_list_lock\u0027 mediante down_read(\u0026amp;triggers_list_lock);\\n[ 1362.207511] [\u0026lt;8054eb38\u0026gt;] led_trigger_write+0xd8/0x14c\\n[ 1362.212566] [\u0026lt;80381d98\u0026gt;] sysfs_kf_bin_write+0x80/0xbc\\n[ 1362.217688] [\u0026lt;8037fcd8\u0026gt;] kernfs_fop_write_iter+0x17c/0x28c\\n[ 1362.223174] [\u0026lt;802cbd70\u0026gt;] vfs_write+0x21c/0x3c4\\n[ 1362.227712] [\u0026lt;802cc0c4\u0026gt;] ksys_write+0x78/0x12c\\n[ 1362.232164] [\u0026lt;80014504\u0026gt;] syscall_common+0x34/0x58\\n\\nAqu\u00ed LEDS_TRIGGER_NETDEV est\u00e1 siendo habilitado en un LED. Primero toma triggers_list_lock y luego RTNL. Un interbloqueo AB-BA cl\u00e1sico.\\n\\nphy_led_triggers_registers() no requiere el RTNL, no realiza ninguna llamada a la pila de red que requiera protecci\u00f3n. Tampoco existe el requisito de que el PHY haya sido conectado a un MAC, los disparadores solo hacen uso del estado de phydev. Esto permite que la llamada a phy_led_triggers_registers() se coloque en otro lugar. PHY probe() y release() no mantienen RTNL, resolviendo as\u00ed el interbloqueo AB-BA.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/phy/phy_device.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"06f502f57d0d7728f9fa0f157ec5e4111ddb98f6\",\"lessThan\":\"2b01518eabace18f7ec8b4cafd52082303080dca\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"06f502f57d0d7728f9fa0f157ec5e4111ddb98f6\",\"lessThan\":\"305afdd02ff3e694c165457793104710ec0728e5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"06f502f57d0d7728f9fa0f157ec5e4111ddb98f6\",\"lessThan\":\"c6ffc2d2338d325e1edd0c702e3ee623aa5fdc6a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"06f502f57d0d7728f9fa0f157ec5e4111ddb98f6\",\"lessThan\":\"c33523b8fd2d4c504ada18cd93f511f2a8f84217\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"06f502f57d0d7728f9fa0f157ec5e4111ddb98f6\",\"lessThan\":\"241cd64cf2e32b28ead151b1795cd8fef2b6e482\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"06f502f57d0d7728f9fa0f157ec5e4111ddb98f6\",\"lessThan\":\"2764dcb3c35de4410f642afc62cf979727470575\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"06f502f57d0d7728f9fa0f157ec5e4111ddb98f6\",\"lessThan\":\"cde2d0b5ab5d03b5b6f17d4f654d8b30ccf36757\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"06f502f57d0d7728f9fa0f157ec5e4111ddb98f6\",\"lessThan\":\"c8dbdc6e380e7e96a51706db3e4b7870d8a9402d\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/phy/phy_device.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.16\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.16\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.253\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.203\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.167\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.130\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.78\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.17\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.7\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\",\"affectedData\":[{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.5\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.5\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.5\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.5\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.5\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-667\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.16.1\",\"versionEndExcluding\":\"5.10.253\",\"matchCriteriaId\":\"96C0EA12-83B8-4804-94AB-EF34257BCBDF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.203\",\"matchCriteriaId\":\"20DDB3E9-AABF-4107-ADB0-5362AA067045\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.167\",\"matchCriteriaId\":\"2EDC6BAF-B710-4E26-B6AA-D68922EE7B43\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.130\",\"matchCriteriaId\":\"C57BB918-DF28-46B3-94F7-144176841267\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.78\",\"matchCriteriaId\":\"28D591F5-B196-4CC9-905C-DC80F116E7A8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.17\",\"matchCriteriaId\":\"A5E006E4-59C7-43C1-9231-62A72219F2BA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.7\",\"matchCriteriaId\":\"69245D10-0B71-485E-80C3-A64F077004D3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:4.16:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"F60469AF-0A23-41D3-BC6A-C0D9A45A2CBC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"F253B622-8837-4245-BCE5-A7BF8FC76A16\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F666C8D8-6538-46D4-B318-87610DE64C34\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"02259FDA-961B-47BC-AE7F-93D7EC6E90C2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"1D2315C0-D46F-4F85-9754-F9E5E11374A6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"512EE3A8-A590-4501-9A94-5D4B268D6138\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/241cd64cf2e32b28ead151b1795cd8fef2b6e482\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2764dcb3c35de4410f642afc62cf979727470575\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2b01518eabace18f7ec8b4cafd52082303080dca\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/305afdd02ff3e694c165457793104710ec0728e5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c33523b8fd2d4c504ada18cd93f511f2a8f84217\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c6ffc2d2338d325e1edd0c702e3ee623aa5fdc6a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c8dbdc6e380e7e96a51706db3e4b7870d8a9402d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cde2d0b5ab5d03b5b6f17d4f654d8b30ccf36757\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-019113.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-082556.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-28T07:20:32+00:00",
      "cve": "CVE-2026-23368",
      "id": "CVE-2026-23368",
      "initial_release_date": "2026-03-25T00:00:00+00:00",
      "product_status:known_affected": "246",
      "product_status:known_not_affected": "28",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23368.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T01:36:53Z",
      "cve": "CVE-2026-23368",
      "id": "CVE-2026-23368",
      "initial_release_date": "2026-03-25T16:55:24Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "214",
      "product_status:known_not_affected": "153",
      "product_status:recommended": "280",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-23368",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-23368.json",
      "version": "20"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.