CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock

Published Mar 25, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

net: phy: register phy ledtriggers during probe to avoid AB-BA deadlock

There is an AB-BA deadlock when both LEDSTRIGGERNETDEV and LEDTRIGGERPHY are enabled:

[ 1362.049207] [<8054e4b8>] ledtriggerregister+0x5c/0x1fc <-- Trying to get lock "triggerslistlock" via downwrite(&triggerslistlock); [ 1362.054536] [<80662830>] phyledtriggersregister+0xd0/0x234 [ 1362.060329] [<8065e200>] phyattachdirect+0x33c/0x40c [ 1362.065489] [<80651fc4>] phylinkfwnodephyconnect+0x15c/0x23c [ 1362.071480] [<8066ee18>] mtkopen+0x7c/0xba0 [ 1362.075849] [<806d714c>] devopen+0x280/0x2b0 [ 1362.080384] [<806d7668>] devchangeflags+0x244/0x24c [ 1362.085598] [<806d7698>] devchangeflags+0x28/0x78 [ 1362.090528] [<807150e4>] devioctl+0x4c0/0x654 <-- Hold lock "rtnlmutex" by calling rtnllock(); [ 1362.094985] [<80694360>] sockioctl+0x2f4/0x4e0 [ 1362.099567] [<802e9c4c>] sysioctl+0x32c/0xd8c [ 1362.104022] [<80014504>] syscallcommon+0x34/0x58

Here LEDTRIGGERPHY is registering LED triggers during phyattach while holding RTNL and then taking triggerslistlock.

[ 1362.191101] [<806c2640>] registernetdevicenotifier+0x60/0x168 <-- Trying to get lock "rtnlmutex" via rtnllock(); [ 1362.197073] [<805504ac>] netdevtrigactivate+0x194/0x1e4 [ 1362.202490] [<8054e28c>] ledtriggerset+0x1d4/0x360 <-- Hold lock "triggerslistlock" by downread(&triggerslistlock); [ 1362.207511] [<8054eb38>] ledtriggerwrite+0xd8/0x14c [ 1362.212566] [<80381d98>] sysfskfbinwrite+0x80/0xbc [ 1362.217688] [<8037fcd8>] kernfsfopwriteiter+0x17c/0x28c [ 1362.223174] [<802cbd70>] vfswrite+0x21c/0x3c4 [ 1362.227712] [<802cc0c4>] ksyswrite+0x78/0x12c [ 1362.232164] [<80014504>] syscallcommon+0x34/0x58

Here LEDSTRIGGERNETDEV is being enabled on an LED. It first takes triggerslistlock and then RTNL. A classical AB-BA deadlock.

phyledtriggersregisters() does not require the RTNL, it does not make any calls into the network stack which require protection. There is also no requirement the PHY has been attached to a MAC, the triggers only make use of phydev state. This allows the call to phyledtriggersregisters() to be placed elsewhere. PHY probe() and release() don't hold RTNL, so solving the AB-BA deadlock.

Affected Software

17 affected componentsFixes available
Linux Linux kernel
Microsoft azl3 kernel 6.6.126.1-1
Linux Linux kernel>=4.16.1<5.10.253
Linux Linux kernel>=5.11<5.15.203
Linux Linux kernel>=5.16<6.1.167
Linux Linux kernel>=6.2<6.6.130
Linux Linux kernel>=6.7<6.12.78
Linux Linux kernel>=6.13<6.18.17
Linux Linux kernel>=6.19<6.19.7
Linux Linux kernel=4.16
Linux Linux kernel=7.0-rc1
Linux Linux kernel=7.0-rc2
Linux Linux kernel=7.0-rc3
Linux Linux kernel=7.0-rc4
Linux Linux kernel=7.0-rc5
Linux Linux kernel=7.0-rc6
Linux Linux kernel=7.0-rc7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Compensating control

    Avoid enabling LEDS_TRIGGER_NETDEV while PHY LED triggers are being registered/attached (i.e., during phy_attach/probe), since the AB-BA deadlock can occur when one path holds triggers_list_lock and the other path holds rtnl_mutex and then tries to take the other lock.

Event History

Mar 25, 2026
CVE Published
via MITRE·10:27 AM
Data Sourced
via MITRE·10:27 AM
Description
Data Sourced
via NVD·11:16 AM
RemedyDescriptionSeverityWeaknessAffected Software
Mar 26, 2026
Data Sourced
via Microsoft·08:03 AM
DescriptionSeverityWeaknessAffected Software
Updated
via Microsoft·08:03 AM
DescriptionSeverity

Frequently Asked Questions

1

What is the severity of CVE-2026-23368?

CVE-2026-23368 is classified as a vulnerability that can lead to an AB-BA deadlock in the Linux kernel.

2

How do I fix CVE-2026-23368?

To fix CVE-2026-23368, users should update their Linux kernel to a version that includes the patch addressing the deadlock issue.

3

What systems are affected by CVE-2026-23368?

CVE-2026-23368 affects various versions of the Linux kernel that utilize the LEDS_TRIGGER_NETDEV and LED_TRIGGER_PHY features.

4

What are the symptoms of the CVE-2026-23368 vulnerability?

The CVE-2026-23368 vulnerability may lead to a system hang or crash due to the AB-BA deadlock during network and LED triggering operations.

5

Is CVE-2026-23368 related to any specific Linux kernel versions?

CVE-2026-23368 affects specific configurations within the Linux kernel but details on affected versions should be referenced in kernel release notes.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203