CVE-2026-53323: Linux Kernel DSA Deadlock Vulnerability in ethtool Operations

Technical summary

The vulnerability resides in DSA's ethtool operations wrappers for the conduit (master) network device. DSA intercepts and wraps the original ethtool_ops to aggregate statistics from both the conduit device and its managed switch ports. However, these wrappers redundantly call netdev_lock_ops() to acquire a lock that the calling ethtool operation already holds. This results in a classic deadlock when ethtool queries are issued on systems with DSA-enabled network devices. The issue was discovered during boot testing with fbnic (Facebook's network interface card driver) and CONFIG_NET_DSA_LOOP enabled, where a simple `ethtool -i` command reproduces the hang. The fix removes the redundant lock acquisition calls from the DSA wrapper functions.

Business impact

Any production system using DSA-enabled network hardware becomes unstable or unresponsive when administrative tools attempt to query network interface properties. This impacts availability and operational visibility—administrators cannot diagnose network issues using standard ethtool utilities, and the kernel deadlock may require a hard reboot. For data center and enterprise environments deploying switch-on-a-chip or similar distributed switching architectures, this creates a significant operational liability and may force workarounds that bypass legitimate diagnostics.

Affected systems

The vulnerability affects Linux kernel systems that have both: (1) DSA support enabled in the kernel configuration, and (2) network drivers that use the locked ethtool operations path (such as fbnic). This is most relevant to systems using managed switch hardware that the kernel controls via DSA, particularly modern SmartNICs and network processors. Desktop and embedded Linux systems without DSA hardware are unaffected; however, cloud infrastructure, networking appliances, and edge computing platforms using advanced network interface cards are at risk.

Exploitability

The vulnerability requires local access and the ability to execute ethtool commands as a non-root user (though root access is typical). No special exploit code is needed—a standard ethtool invocation triggers the deadlock. However, it is not a remote vulnerability and does not grant privilege escalation or data access; it is purely a denial-of-service condition affecting system availability. An attacker with local shell access can trivially hang the kernel.

Remediation

The Linux kernel fix removes the redundant netdev_lock_ops() and netdev_unlock_ops() calls from the DSA conduit ethtool operation wrappers. This allows the ethtool calls to proceed without the double-lock deadlock. Organizations should apply kernel updates that incorporate this fix once they are released by their distribution. For interim mitigation, disable DSA (CONFIG_NET_DSA=n) if the network hardware topology permits, or restrict ethtool access to trusted administrators.

Patch guidance

Monitor your Linux distribution's kernel release notes and security advisories for patches addressing this deadlock. Vendors typically backport the fix to supported stable kernel branches. Apply patches to all systems running kernel configurations with DSA enabled, prioritizing production servers and network infrastructure. Verify the fix by confirming that ethtool commands no longer hang on affected hardware. Testing on non-critical systems before broad rollout is recommended given the sensitive nature of kernel-level locking changes.

Detection guidance

Monitor for kernel hang or lockup events coinciding with ethtool command execution. Check kernel logs (dmesg, journalctl) for deadlock detection warnings or soft lockup reports on CPUs running ethtool. Network monitoring tools may show connection loss or timeout if the affected interface is critical. Proactively test environments by running `ethtool -i` on DSA-enabled interfaces; if the command hangs, the system is vulnerable. Automated compliance checks can verify kernel version against known-patched releases.

Why prioritize this

Although this is a denial-of-service vulnerability with no data breach or privilege escalation risk, it merits prompt patching because: (1) it affects system availability and diagnostic capability, (2) it requires no special exploit—standard tools trigger it, (3) it impacts modern network hardware deployments increasingly common in cloud and data-center environments, and (4) the fix is straightforward and carries minimal regression risk. Medium CVSS severity is appropriate for a local DoS without privilege impact.

Risk score, explained

The CVSS 3.1 score of 5.5 (Medium) reflects a local attack vector (AV:L), low complexity (AC:L), and low privileges required (PR:L), resulting in high availability impact (A:H). No confidentiality or integrity impact occurs. The Medium severity is justified: while the deadlock is trivial to trigger and completely denies service, it requires local access and does not escalate privileges or compromise data. This makes it less critical than remote or privilege-escalating flaws, but more urgent than minor bugs.

Frequently asked questions