CVE-2026-23368
published 2026-03-25CVE-2026-23368: In the Linux kernel, the following vulnerability has been resolved: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock There is an AB-BA…
PriorityP421medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.10%
1.0th percentile
In the Linux kernel, the following vulnerability has been resolved:
net: phy: register phy led_triggers during probe to avoid AB-BA deadlock
There is an AB-BA deadlock when both LEDS_TRIGGER_NETDEV and
LED_TRIGGER_PHY are enabled:
[ 1362.049207] [] led_trigger_register+0x5c/0x1fc ] phy_led_triggers_register+0xd0/0x234
[ 1362.060329] [] phy_attach_direct+0x33c/0x40c
[ 1362.065489] [] phylink_fwnode_phy_connect+0x15c/0x23c
[ 1362.071480] [] mtk_open+0x7c/0xba0
[ 1362.075849] [] __dev_open+0x280/0x2b0
[ 1362.080384] [] __dev_change_flags+0x244/0x24c
[ 1362.085598] [] dev_change_flags+0x28/0x78
[ 1362.090528] [] dev_ioctl+0x4c0/0x654 ] sock_ioctl+0x2f4/0x4e0
[ 1362.099567] [] sys_ioctl+0x32c/0xd8c
[ 1362.104022] [] syscall_common+0x34/0x58
Here LED_TRIGGER_PHY is registering LED triggers during phy_attach
while holding RTNL and then taking triggers_list_lock.
[ 1362.191101] [] register_netdevice_notifier+0x60/0x168 ] netdev_trig_activate+0x194/0x1e4
[ 1362.202490] [] led_trigger_set+0x1d4/0x360 ] led_trigger_write+0xd8/0x14c
[ 1362.212566] [] sysfs_kf_bin_write+0x80/0xbc
[ 1362.217688] [] kernfs_fop_write_iter+0x17c/0x28c
[ 1362.223174] [] vfs_write+0x21c/0x3c4
[ 1362.227712] [] ksys_write+0x78/0x12c
[ 1362.232164] [] syscall_common+0x34/0x58
Here LEDS_TRIGGER_NETDEV is being enabled on an LED. It first takes
triggers_list_lock and then RTNL. A classical AB-BA deadlock.
phy_led_triggers_registers() does not require the RTNL, it does not
make any calls into the network stack which require protection. There
is also no requirement the PHY has been attached to a MAC, the
triggers only make use of phydev state. This allows the call to
phy_led_triggers_registers() to be placed elsewhere. PHY probe() and
release() don't hold RTNL, so solving the AB-BA deadlock.
Affected
69 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.19.8-1 (forky) | linux 6.19.8-1 (forky) |
| linux | linux | — | — |
| linux | linux | >= 06f502f57d0d7728f9fa0f157ec5e4111ddb98f6 < 2b01518eabace18f7ec8b4cafd52082303080dca | 2b01518eabace18f7ec8b4cafd52082303080dca |
| linux | linux | >= 06f502f57d0d7728f9fa0f157ec5e4111ddb98f6 < 305afdd02ff3e694c165457793104710ec0728e5 | 305afdd02ff3e694c165457793104710ec0728e5 |
| linux | linux | >= 06f502f57d0d7728f9fa0f157ec5e4111ddb98f6 < c6ffc2d2338d325e1edd0c702e3ee623aa5fdc6a | c6ffc2d2338d325e1edd0c702e3ee623aa5fdc6a |
| linux | linux | >= 06f502f57d0d7728f9fa0f157ec5e4111ddb98f6 < c33523b8fd2d4c504ada18cd93f511f2a8f84217 | c33523b8fd2d4c504ada18cd93f511f2a8f84217 |
| linux | linux | >= 06f502f57d0d7728f9fa0f157ec5e4111ddb98f6 < 241cd64cf2e32b28ead151b1795cd8fef2b6e482 | 241cd64cf2e32b28ead151b1795cd8fef2b6e482 |
| linux | linux | >= 06f502f57d0d7728f9fa0f157ec5e4111ddb98f6 < 2764dcb3c35de4410f642afc62cf979727470575 | 2764dcb3c35de4410f642afc62cf979727470575 |
| linux | linux | >= 06f502f57d0d7728f9fa0f157ec5e4111ddb98f6 < cde2d0b5ab5d03b5b6f17d4f654d8b30ccf36757 | cde2d0b5ab5d03b5b6f17d4f654d8b30ccf36757 |
| linux | linux | >= 06f502f57d0d7728f9fa0f157ec5e4111ddb98f6 < c8dbdc6e380e7e96a51706db3e4b7870d8a9402d | c8dbdc6e380e7e96a51706db3e4b7870d8a9402d |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.19.8-1 | 6.19.8-1 |
| linux | linux_kernel | >= 4.16.0 < 6.1.167 | 6.1.167 |
| linux | linux_kernel | >= 4.16.1 < 5.10.253 | 5.10.253 |
| linux | linux_kernel | >= 5.11 < 5.15.203 | 5.15.203 |
| linux | linux_kernel | >= 5.16 < 6.1.167 | 6.1.167 |
| linux | linux_kernel | >= 6.13 < 6.18.17 | 6.18.17 |
| linux | linux_kernel | >= 6.13.0 < 6.18.17 | 6.18.17 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vendor_ubuntu7.1HIGH
vendor_msrc5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-07-28·CVSS 7.1
CVE-2024-36898 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Maxim Suhanov discovered that the NTFS file system implementation in the
Linux kernel did not properly validate file name length in certain
situations, leading to an out-of-bounds read. An attacker could use this to
construct a malicious NTFS image that, when mounted and operated on, could
expose sensitive information (kernel memory). (CVE-2023-45896)
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local
Ubuntu
Linux kernel (HWE) vulnerabilities
vendor_ubuntu·2026-07-28·CVSS 2.0
CVE-2026-46073 [LOW] Linux kernel (HWE) vulnerabilities
Title: Linux kernel (HWE) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A local a
Ubuntu
Linux kernel (Azure CVM) vulnerabilities
vendor_ubuntu·2026-07-24·CVSS 2.0
CVE-2026-46073 [LOW] Linux kernel (Azure CVM) vulnerabilities
Title: Linux kernel (Azure CVM) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A l
Ubuntu
Linux kernel (Azure FIPS) vulnerabilities
vendor_ubuntu·2026-07-24·CVSS 2.0
CVE-2026-46073 [LOW] Linux kernel (Azure FIPS) vulnerabilities
Title: Linux kernel (Azure FIPS) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A
Ubuntu
Linux kernel (Azure CVM) vulnerabilities
vendor_ubuntu·2026-07-24·CVSS 2.0
CVE-2026-43129 [LOW] Linux kernel (Azure CVM) vulnerabilities
Title: Linux kernel (Azure CVM) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A l
Ubuntu
Linux kernel (Azure CVM) vulnerabilities
vendor_ubuntu·2026-07-24·CVSS 7.1
CVE-2024-36898 [HIGH] Linux kernel (Azure CVM) vulnerabilities
Title: Linux kernel (Azure CVM) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Maxim Suhanov discovered that the NTFS file system implementation in the
Linux kernel did not properly validate file name length in certain
situations, leading to an out-of-bounds read. An attacker could use this to
construct a malicious NTFS image that, when mounted and operated on, could
expose sensitive information (kernel memory). (CVE-2023-45896)
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cac
Ubuntu
Linux kernel (Azure) vulnerabilities
vendor_ubuntu·2026-07-24·CVSS 2.0
CVE-2026-46073 [LOW] Linux kernel (Azure) vulnerabilities
Title: Linux kernel (Azure) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A local
Ubuntu
Linux kernel (AWS) vulnerabilities
vendor_ubuntu·2026-07-24·CVSS 2.0
CVE-2026-46073 [LOW] Linux kernel (AWS) vulnerabilities
Title: Linux kernel (AWS) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A local a
Ubuntu
Linux kernel (Oracle) vulnerabilities
vendor_ubuntu·2026-07-23·CVSS 2.0
CVE-2026-46073 [LOW] Linux kernel (Oracle) vulnerabilities
Title: Linux kernel (Oracle) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A loca
Ubuntu
Linux kernel (NVIDIA) vulnerabilities
vendor_ubuntu·2026-07-23·CVSS 2.0
CVE-2026-43129 [LOW] Linux kernel (NVIDIA) vulnerabilities
Title: Linux kernel (NVIDIA) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A loca
Ubuntu
Linux kernel (IBM) vulnerabilities
vendor_ubuntu·2026-07-23·CVSS 7.1
CVE-2026-46187 [HIGH] Linux kernel (IBM) vulnerabilities
Title: Linux kernel (IBM) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Maxim Suhanov discovered that the NTFS file system implementation in the
Linux kernel did not properly validate file name length in certain
situations, leading to an out-of-bounds read. An attacker could use this to
construct a malicious NTFS image that, when mounted and operated on, could
expose sensitive information (kernel memory). (CVE-2023-45896)
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-07-23·CVSS 7.1
CVE-2026-46187 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Maxim Suhanov discovered that the NTFS file system implementation in the
Linux kernel did not properly validate file name length in certain
situations, leading to an out-of-bounds read. An attacker could use this to
construct a malicious NTFS image that, when mounted and operated on, could
expose sensitive information (kernel memory). (CVE-2023-45896)
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local
Ubuntu
Linux kernel (NVIDIA Tegra) vulnerabilities
vendor_ubuntu·2026-07-23·CVSS 7.1
CVE-2026-46187 [HIGH] Linux kernel (NVIDIA Tegra) vulnerabilities
Title: Linux kernel (NVIDIA Tegra) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Maxim Suhanov discovered that the NTFS file system implementation in the
Linux kernel did not properly validate file name length in certain
situations, leading to an out-of-bounds read. An attacker could use this to
construct a malicious NTFS image that, when mounted and operated on, could
expose sensitive information (kernel memory). (CVE-2023-45896)
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-07-23·CVSS 2.0
CVE-2026-46073 [LOW] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A local attacke
Ubuntu
Linux kernel (GCP FIPS) vulnerabilities
vendor_ubuntu·2026-07-21·CVSS 2.0
CVE-2026-46073 [LOW] Linux kernel (GCP FIPS) vulnerabilities
Title: Linux kernel (GCP FIPS) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A lo
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-07-21·CVSS 7.1
CVE-2024-36898 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Maxim Suhanov discovered that the NTFS file system implementation in the
Linux kernel did not properly validate file name length in certain
situations, leading to an out-of-bounds read. An attacker could use this to
construct a malicious NTFS image that, when mounted and operated on, could
expose sensitive information (kernel memory). (CVE-2023-45896)
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local
Ubuntu
Linux kernel (NVIDIA Tegra) vulnerabilities
vendor_ubuntu·2026-07-21·CVSS 7.1
CVE-2024-36898 [HIGH] Linux kernel (NVIDIA Tegra) vulnerabilities
Title: Linux kernel (NVIDIA Tegra) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Maxim Suhanov discovered that the NTFS file system implementation in the
Linux kernel did not properly validate file name length in certain
situations, leading to an out-of-bounds read. An attacker could use this to
construct a malicious NTFS image that, when mounted and operated on, could
expose sensitive information (kernel memory). (CVE-2023-45896)
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-07-20·CVSS 2.0
CVE-2026-46073 [LOW] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A local attacke
Red Hat
kernel: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock
vendor_redhat·2026-03-25·CVSS 5.5
CVE-2026-23368 [MEDIUM] CWE-833 kernel: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock
kernel: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock
In the Linux kernel, the following vulnerability has been resolved:
net: phy: register phy led_triggers during probe to avoid AB-BA deadlock
There is an AB-BA deadlock when both LEDS_TRIGGER_NETDEV and
LED_TRIGGER_PHY are enabled:
[ 1362.049207] [] led_trigger_register+0x5c/0x1fc ] phy_led_triggers_register+0xd0/0x234
[ 1362.060329] [] phy_attach_direct+0x33c/0x40c
[ 1362.065489] [] phylink_fwnode_phy_connect+0x15c/0x23c
[ 1362.071480] [] mtk_open+0x7c/0xba0
[ 1362.075849] [] __dev_open+0x280/0x2b0
[ 1362.080384] [] __dev_change_flags+0x244/0x24c
[ 1362.085598] [] dev_change_flags+0x28/0x78
[ 1362.090528] [] dev_ioctl+0x4c0/0x654 ] sock_ioctl+0x2f4/0x4e0
[ 1362.099567] [] sys_ioctl+0x32c/0xd8c
[ 1362.104022]
Microsoft
net: phy: register phy led_triggers during probe to avoid AB-BA deadlock
vendor_msrc·2026-03-10·CVSS 5.5
CVE-2026-23368 [MEDIUM] net: phy: register phy led_triggers during probe to avoid AB-BA deadlock
net: phy: register phy led_triggers during probe to avoid AB-BA deadlock
Mariner: Mariner
Linux: Linux
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade
Debian
CVE-2026-23368: linux - In the Linux kernel, the following vulnerability has been resolved: net: phy: r...
vendor_debian·2026
CVE-2026-23368 CVE-2026-23368: linux - In the Linux kernel, the following vulnerability has been resolved: net: phy: r...
In the Linux kernel, the following vulnerability has been resolved: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock There is an AB-BA deadlock when both LEDS_TRIGGER_NETDEV and LED_TRIGGER_PHY are enabled: [ 1362.049207] [] led_trigger_register+0x5c/0x1fc ] phy_led_triggers_register+0xd0/0x234 [ 1362.060329] [] phy_attach_direct+0x33c/0x40c [ 1362.065489] [] phylink_fwnode_phy_connect+0x15c/0x23c [ 1362.071480] [] mtk_open+0x7c/0xba0 [ 1362.075849] [] __dev_open+0x280/0x2b0 [ 1362.080384] [] __dev_change_flags+0x244/0x24c [ 1362.085598] [] dev_change_flags+0x28/0x78 [ 1362.090528] [] dev_ioctl+0x4c0/0x654 ] sock_ioctl+0x2f4/0x4e0 [ 1362.099567] [] sys_ioctl+0x32c/0xd8c [ 1362.104022] [] syscall_common+0x34/0x58 Here LED_TRIGGER_PHY is registering LED triggers durin
OSV
net: phy: register phy led_triggers during probe to avoid AB-BA deadlock
osv·2026-03-25
CVE-2026-23368 net: phy: register phy led_triggers during probe to avoid AB-BA deadlock
net: phy: register phy led_triggers during probe to avoid AB-BA deadlock
In the Linux kernel, the following vulnerability has been resolved:
net: phy: register phy led_triggers during probe to avoid AB-BA deadlock
There is an AB-BA deadlock when both LEDS_TRIGGER_NETDEV and
LED_TRIGGER_PHY are enabled:
[ 1362.049207] [] led_trigger_register+0x5c/0x1fc ] phy_led_triggers_register+0xd0/0x234
[ 1362.060329] [] phy_attach_direct+0x33c/0x40c
[ 1362.065489] [] phylink_fwnode_phy_connect+0x15c/0x23c
[ 1362.071480] [] mtk_open+0x7c/0xba0
[ 1362.075849] [] __dev_open+0x280/0x2b0
[ 1362.080384] [] __dev_change_flags+0x244/0x24c
[ 1362.085598] [] dev_change_flags+0x28/0x78
[ 1362.090528] [] dev_ioctl+0x4c0/0x654 ] sock_ioctl+0x2f4/0x4e0
[ 1362.099567] [] sys_ioctl+0x32c/0xd8c
[ 1362.104022] [] sy
OSV
CVE-2026-23368: In the Linux kernel, the following vulnerability has been resolved: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock There is
osv·2026-03-25
CVE-2026-23368 CVE-2026-23368: In the Linux kernel, the following vulnerability has been resolved: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock There is
In the Linux kernel, the following vulnerability has been resolved: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock There is an AB-BA deadlock when both LEDS_TRIGGER_NETDEV and LED_TRIGGER_PHY are enabled: [ 1362.049207] [] led_trigger_register+0x5c/0x1fc ] phy_led_triggers_register+0xd0/0x234 [ 1362.060329] [] phy_attach_direct+0x33c/0x40c [ 1362.065489] [] phylink_fwnode_phy_connect+0x15c/0x23c [ 1362.071480] [] mtk_open+0x7c/0xba0 [ 1362.075849] [] __dev_open+0x280/0x2b0 [ 1362.080384] [] __dev_change_flags+0x244/0x24c [ 1362.085598] [] dev_change_flags+0x28/0x78 [ 1362.090528] [] dev_ioctl+0x4c0/0x654 ] sock_ioctl+0x2f4/0x4e0 [ 1362.099567] [] sys_ioctl+0x32c/0xd8c [ 1362.104022] [] syscall_common+0x34/0x58 Here LED_TRIGGER_PHY is registering LED triggers durin
GHSA
GHSA-qvjj-9xg3-chp9: In the Linux kernel, the following vulnerability has been resolved:
net: phy: register phy led_triggers during probe to avoid AB-BA deadlock
There i
ghsa_unreviewed·2026-03-25
CVE-2026-23368 GHSA-qvjj-9xg3-chp9: In the Linux kernel, the following vulnerability has been resolved:
net: phy: register phy led_triggers during probe to avoid AB-BA deadlock
There i
In the Linux kernel, the following vulnerability has been resolved:
net: phy: register phy led_triggers during probe to avoid AB-BA deadlock
There is an AB-BA deadlock when both LEDS_TRIGGER_NETDEV and
LED_TRIGGER_PHY are enabled:
[ 1362.049207] [] led_trigger_register+0x5c/0x1fc ] phy_led_triggers_register+0xd0/0x234
[ 1362.060329] [] phy_attach_direct+0x33c/0x40c
[ 1362.065489] [] phylink_fwnode_phy_connect+0x15c/0x23c
[ 1362.071480] [] mtk_open+0x7c/0xba0
[ 1362.075849] [] __dev_open+0x280/0x2b0
[ 1362.080384] [] __dev_change_flags+0x244/0x24c
[ 1362.085598] [] dev_change_flags+0x28/0x78
[ 1362.090528] [] dev_ioctl+0x4c0/0x654 ] sock_ioctl+0x2f4/0x4e0
[ 1362.099567] [] sys_ioctl+0x32c/0xd8c
[ 1362.104022] [] syscall_common+0x34/0x58
Here LED_TRIGGER_PHY is registering LED triggers d
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-23368 kernel: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock
bugzilla·2026-03-25·CVSS 5.5
CVE-2026-23368 [MEDIUM] CVE-2026-23368 kernel: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock
CVE-2026-23368 kernel: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock
In the Linux kernel, the following vulnerability has been resolved:
net: phy: register phy led_triggers during probe to avoid AB-BA deadlock
There is an AB-BA deadlock when both LEDS_TRIGGER_NETDEV and
LED_TRIGGER_PHY are enabled:
[ 1362.049207] [] led_trigger_register+0x5c/0x1fc ] phy_led_triggers_register+0xd0/0x234
[ 1362.060329] [] phy_attach_direct+0x33c/0x40c
[ 1362.065489] [] phylink_fwnode_phy_connect+0x15c/0x23c
[ 1362.071480] [] mtk_open+0x7c/0xba0
[ 1362.075849] [] __dev_open+0x280/0x2b0
[ 1362.080384] [] __dev_change_flags+0x244/0x24c
[ 1362.085598] [] dev_change_flags+0x28/0x78
[ 1362.090528] [] dev_ioctl+0x4c0/0x654 ] sock_ioctl+0x2f4/0x4e0
[ 1362.099567] [] sys_ioctl+0x32c/0xd
Wiz
CVE-2026-23368 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz
CVE-2026-23368 CVE-2026-23368 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-23368 :
Linux Kernel vulnerability analysis and mitigation
In the Linux kernel, the following vulnerability has been resolved:
net: phy: register phy led_triggers during probe to avoid AB-BA deadlock
There is an AB-BA deadlock when both LEDS_TRIGGER_NETDEV and
LED_TRIGGER_PHY are enabled:
[ 1362.049207] [] led_trigger_register+0x5c/0x1fc ] phy_led_triggers_register+0xd0/0x234
[ 1362.060329] [] phy_attach_direct+0x33c/0x40c
[ 1362.065489] [] phylink_fwnode_phy_connect+0x15c/0x23c
[ 1362.071480] [] mtk_open+0x7c/0xba0
[ 1362.075849] [] __dev_open+0x280/0x2b0
[ 1362.080384] [] __dev_change_flags+0x244/0x24c
[ 1362.085598] [] dev_change_flags+0x28/0x78
[ 1362.090528] [] dev_ioctl+0x4c0/0x654 ] sock_ioctl+0x2f4/0x4e0
[ 1362.099567] [] sys_ioctl+0x32c/0xd8c
[ 1362.104022] [] sys
https://git.kernel.org/stable/c/241cd64cf2e32b28ead151b1795cd8fef2b6e482https://git.kernel.org/stable/c/2764dcb3c35de4410f642afc62cf979727470575https://git.kernel.org/stable/c/2b01518eabace18f7ec8b4cafd52082303080dcahttps://git.kernel.org/stable/c/305afdd02ff3e694c165457793104710ec0728e5https://git.kernel.org/stable/c/c33523b8fd2d4c504ada18cd93f511f2a8f84217https://git.kernel.org/stable/c/c6ffc2d2338d325e1edd0c702e3ee623aa5fdc6ahttps://git.kernel.org/stable/c/c8dbdc6e380e7e96a51706db3e4b7870d8a9402dhttps://git.kernel.org/stable/c/cde2d0b5ab5d03b5b6f17d4f654d8b30ccf36757https://cert-portal.siemens.com/productcert/html/ssa-019113.htmlhttps://cert-portal.siemens.com/productcert/html/ssa-082556.html
2026-03-25
Published