PT-2026-43716 · Linux · Linux

Published 2026-05-27 · Updated 2026-05-27 · CVE-2026-45849

NVD

In the Linux kernel, the following vulnerability has been resolved:

net: mscc: ocelot: add missing lock protection in ocelot port xmit inj()

ocelot port xmit inj() calls ocelot can inject() and ocelot port inject frame() without holding the injection group lock. Both functions contain lockdep assert held() for the injection lock, and the correct caller felix port deferred xmit() properly acquires the lock using ocelot lock inj grp() before calling these functions.

Add ocelot lock inj grp()/ocelot unlock inj grp() around the register injection path to fix the missing lock protection. The FDMA path is not affected as it uses its own locking mechanism.

Related Identifiers

CVE-2026-45849

Affected Products

Linux

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-45849 · Security Note
• https://git.kernel.org/stable/c/51c32ae7fae14552d79f7139614b77c1bbd57a48 · Note
• https://git.kernel.org/stable/c/0b217a40156f497e09dd20d3f7baec40c785f386 · Note
• https://git.kernel.org/stable/c/63da961381e0d979459dede713001f8452364477 · Note
• https://git.kernel.org/stable/c/cc1b179f778f98270bdbbb48d183b4b6427ae198 · Note
• https://git.kernel.org/stable/c/7ac58d8832802ec89baa7539e13e6d58a88cce04 · Note
• https://git.kernel.org/stable/c/026f6513c5880c2c89e38ad66bbec2868f978605 · Note