CVE-2026-23165: sfc: fix deadlock in RSS config read

Q: Is this exploitable remotely?

No. The CVSS vector identifies local attack access (AV:L), with low privileges required and no user interaction.

Q: What does an attacker need to do to trigger the issue?

They need local access with low privileges and must cause an RSS configuration read through the ethtool -x handling path. The issue arises when the sfc driver attempts to lock the net_device RSS lock that the kernel core already holds.

Q: What is the primary security impact?

The reported impact is availability loss. The recursive locking condition can deadlock RSS configuration reads, and the CVSS vector assigns high availability impact while indicating no confidentiality or integrity impact.

Published Feb 14, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

sfc: fix deadlock in RSS config read

Since cited commit, core locks the netdevice's rsslock when handling ethtool -x command, so driver's implementation should not lock it again. Remove the latter.

Affected Software

8 affected components

Linux Linux kernel>=6.17<6.18.9

Linux Linux kernel=6.19-rc1

Linux Linux kernel=6.19-rc2

Linux Linux kernel=6.19-rc3

Linux Linux kernel=6.19-rc4

Linux Linux kernel=6.19-rc5

Linux Linux kernel=6.19-rc6

Linux Linux kernel=6.19-rc7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Configuration
Remove the driver's rss_lock acquisition when handling ethtool -x, because the core already holds net_device's rss_lock.
sfc driver RSS configuration read implementation rss_lock = do not lock

Event History

Feb 14, 2026

CVE Published

via MITRE·04:01 PM

Data Sourced

via MITRE·04:01 PM

Description

Data Sourced

via NVD·04:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Is this exploitable remotely?

No. The CVSS vector identifies local attack access (AV:L), with low privileges required and no user interaction.

What does an attacker need to do to trigger the issue?

They need local access with low privileges and must cause an RSS configuration read through the ethtool -x handling path. The issue arises when the sfc driver attempts to lock the net_device RSS lock that the kernel core already holds.

What is the primary security impact?

The reported impact is availability loss. The recursive locking condition can deadlock RSS configuration reads, and the CVSS vector assigns high availability impact while indicating no confidentiality or integrity impact.

CVE-2026-23165: sfc: fix deadlock in RSS config read

Affected Software

Remediation

Event History

Frequently Asked Questions

Is this exploitable remotely?

What does an attacker need to do to trigger the issue?

What is the primary security impact?

Company

Resources

Contact

Frequently Asked Questions

Is this exploitable remotely?

What does an attacker need to do to trigger the issue?

What is the primary security impact?