UBUNTU-CVE-2026-80739: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock In case mlx5eaddfdbflow() fails in lower levels, the flow is deleted via mlx5etcdelflow(), and mlx5etcdelflow() is acquiring ESW devcom lock without condition. In addition, in case of peerflow, mlx5eaddfdbflow() is called while holding ESW devcom comp lock. This results in an AA deadlock. To fix this, introduce a new PEER flag that is set on flows created as peer flows (the duplicate flows on peer devices), and check it in mlx5etcdelflow() before acquiring ESW devcom lock. Lockdep splat: ============================================ WARNING: possible recursive locking detected ============================================ Possible unsafe locking scenario: CPU0 ---- lock(&comp->lockkey#2); lock(&comp->lockkey#2); DEADLOCK Call Trace: <TASK> dumpstacklvl+0x69/0xa0 printdeadlockbug.cold+0xbd/0xca lockacquire+0x1671/0x2ec0 lockacquire+0x10e/0x2e0 downread+0x95/0x430 mlx5devcomforeachpeerbegin+0x4e/0xe0 [mlx5core] mlx5etcdelflow+0x11d/0xa70 [mlx5core] mlx5eflowput+0x99/0x100 [mlx5core] mlx5eaddfdbflow+0x409/0xf00 [mlx5core] mlx5econfigureflower+0x2a86/0x4100 [mlx5core] mlx5erepsetuptcclsflower+0x12f/0x1b0 [mlx5core] mlx5erepsetuptccb+0x153/0x750 [mlx5core] tcsetupcbadd+0x1dc/0x470 flchange+0x2f4d/0x626d [clsflower] tcnewtfilter+0x79b/0x2310 rtnetlinkrcvmsg+0x778/0xad0 dosyscall64+0x70/0x960 entrySYSCALL64afterhwframe+0x4b/0x53 </TASK>
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
What systems are realistically exposed to this issue?
The issue affects the listed Ubuntu Linux kernel packages, including linux, linux-azure, linux-gcp, linux-fips, linux-aws-fips, linux-azure-fips, linux-gcp-fips, and linux-realtime. Exploitation requires local access and high privileges.
What conditions are needed to trigger the deadlock?
The failure path must delete a peer flow after __mlx5e_add_fdb_flow() fails at a lower level. The problematic path involves mlx5e TC flow handling and ESW devcom locking for peer devices.
What is the practical impact?
The vulnerability can cause a recursive-locking deadlock in the kernel networking driver path. The provided vector indicates availability impact only, with no stated confidentiality or integrity impact.
How can I identify a likely occurrence?
A likely occurrence is indicated by a lockdep warning reporting possible recursive locking and an "*** DEADLOCK ***" condition. The trace may include mlx5e_tc_del_flow, mlx5e_flow_put, mlx5_devcom_for_each_peer_begin, and mlx5_core.