CVE-2026-23368
AB-BA Deadlock in Linux Kernel PHY LED Trigger Registration
Publication date: 2026-03-25
Last updated on: 2026-04-24
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 4.16 |
| linux | linux_kernel | From 6.19 (inc) to 6.19.7 (exc) |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | From 6.13 (inc) to 6.18.17 (exc) |
| linux | linux_kernel | From 6.2 (inc) to 6.6.130 (exc) |
| linux | linux_kernel | From 5.11 (inc) to 5.15.203 (exc) |
| linux | linux_kernel | From 5.16 (inc) to 6.1.167 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.78 (exc) |
| linux | linux_kernel | From 4.16.1 (inc) to 5.10.253 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-667 | The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an AB-BA deadlock in the Linux kernel related to LED trigger registration. It occurs when both LEDS_TRIGGER_NETDEV and LED_TRIGGER_PHY are enabled simultaneously.
The deadlock happens because LED_TRIGGER_PHY registers LED triggers during the PHY attach process while holding the RTNL lock and then tries to acquire the triggers_list_lock. Meanwhile, LEDS_TRIGGER_NETDEV takes the triggers_list_lock first and then tries to acquire the RTNL lock, creating a circular lock dependency (AB-BA deadlock).
The root cause is that phy_led_triggers_register() unnecessarily holds the RTNL lock even though it does not require it, as it does not make calls into the network stack that need protection. The fix involves registering the PHY LED triggers during the PHY probe phase, which does not hold the RTNL lock, thus avoiding the deadlock.
How can this vulnerability impact me? :
This vulnerability can cause a deadlock in the Linux kernel when both LEDS_TRIGGER_NETDEV and LED_TRIGGER_PHY are enabled. A deadlock means that certain kernel operations involving LED triggers and network device locks can freeze, potentially causing system hangs or unresponsiveness.
Such a deadlock can impact system stability and availability, especially in environments relying on these LED triggers for network device status indication or management.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability manifests as an AB-BA deadlock involving LED triggers in the Linux kernel. It can be detected by observing kernel logs for deadlock messages related to led_trigger_register, phy_led_triggers_register, and network device locking (rtnl_mutex).
You can check your system logs (e.g., using dmesg or journalctl) for deadlock traces similar to the following pattern:
- dmesg | grep -i 'led_trigger_register'
- dmesg | grep -i 'phy_led_triggers_register'
- dmesg | grep -i 'rtnl_mutex'
These commands help identify if the AB-BA deadlock described is occurring by searching for relevant kernel stack traces and lock contention messages.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is resolved by changing the registration of phy LED triggers to occur during the PHY probe phase, avoiding holding the RTNL lock while registering LED triggers. Immediate mitigation involves updating the Linux kernel to a version where this fix is applied.
Since the issue arises from the order of acquiring locks (RTNL and triggers_list_lock), avoiding enabling both LEDS_TRIGGER_NETDEV and LED_TRIGGER_PHY simultaneously can reduce the risk until a patch is applied.
In summary, the recommended immediate steps are:
- Update the Linux kernel to a version that includes the fix for this deadlock.
- Avoid enabling both LEDS_TRIGGER_NETDEV and LED_TRIGGER_PHY triggers at the same time on your devices.