CVE-2026-23165: Linux Kernel Race Condition Vulnerability

CVE-2026-23165 Overview

A deadlock vulnerability has been identified in the Linux kernel's sfc network driver related to RSS (Receive Side Scaling) configuration handling. The issue occurs when the driver incorrectly attempts to acquire the rss_lock mutex during ethtool -x command processing, when the kernel core has already locked this resource. This results in a deadlock condition that can render the affected network interface unresponsive.

Critical Impact
Systems running affected Linux kernel versions with Solarflare network adapters may experience network interface lockups and potential denial of service when querying RSS configuration via ethtool.

Affected Products

Linux kernel with sfc network driver
Systems utilizing Solarflare network adapters
Environments using ethtool -x for RSS configuration queries

Discovery Timeline

2026-02-14 - CVE CVE-2026-23165 published to NVD
2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-23165

Vulnerability Analysis

This vulnerability is a classic deadlock race condition in the Linux kernel's sfc driver, which supports Solarflare network adapters. The issue stems from improper locking semantics where the driver attempts to acquire the net_device structure's rss_lock during RSS configuration read operations, while the kernel's ethtool subsystem has already acquired this same lock.

When a user executes the ethtool -x command to query RSS configuration, the kernel core acquires rss_lock before calling into the driver's implementation. The sfc driver was incorrectly attempting to lock this mutex again within its handler, creating a self-deadlock scenario. This means the same thread attempts to acquire a lock it already holds, resulting in an indefinite wait condition.

The deadlock manifests specifically during RSS hash table or indirection table queries, causing the network interface to become unresponsive and potentially impacting system stability for workloads dependent on the affected network adapter.

Root Cause

The root cause is a locking hierarchy violation introduced when the kernel core began locking rss_lock for ethtool RSS operations. The sfc driver was not updated to reflect this change and continued to acquire the lock within its own implementation, resulting in a nested lock acquisition on the same mutex by the same execution context.

Attack Vector

The attack vector for this vulnerability requires local access to execute ethtool commands against affected network interfaces. An unprivileged local user with permission to query network interface configuration could trigger the deadlock condition, causing denial of service to the network interface. The vulnerability is triggered through standard system administration tools without requiring elevated privileges beyond network interface query permissions.

While this is primarily an availability impact, the deadlock could be leveraged as part of a broader attack to disrupt network connectivity on affected systems. No code injection or data manipulation is possible through this vulnerability.

Detection Methods for CVE-2026-23165

Indicators of Compromise

System logs showing hung task warnings related to sfc driver operations
Network interface becomes unresponsive after ethtool -x execution
Kernel soft lockup warnings mentioning RSS configuration functions
dmesg output containing deadlock detector warnings with rss_lock references

Detection Strategies

Monitor for hung task kernel warnings associated with network driver operations
Track ethtool command usage patterns targeting Solarflare network interfaces
Implement system health monitoring for network interface responsiveness
Review kernel logs for mutex deadlock detection warnings

Monitoring Recommendations

Enable kernel lockdep debugging to detect potential deadlock scenarios early
Configure alerting on network interface state changes and driver errors
Monitor system dmesg for sfc driver-related warnings and errors
Implement network interface availability probes to detect unresponsive adapters

How to Mitigate CVE-2026-23165

Immediate Actions Required

Apply the kernel patch that removes the redundant rss_lock acquisition from the sfc driver
Avoid executing ethtool -x commands on affected systems until patched
Consider temporarily restricting ethtool access to administrative users only
Plan maintenance windows to apply kernel updates to affected systems

Patch Information

The fix removes the redundant lock acquisition from the sfc driver's RSS configuration read path. The kernel patches are available through the official Linux kernel git repository:

System administrators should update to kernel versions containing these commits or apply the patches to their running kernel versions.

Workarounds

Restrict ethtool command execution to prevent triggering the deadlock condition
Disable RSS configuration queries on affected interfaces using access controls
Consider using alternative network drivers if available for the hardware
Implement monitoring to detect and alert on interface lockups for rapid response

bash

# Configuration example - Restrict ethtool access temporarily
# Limit ethtool execution to root only
chmod 750 /usr/sbin/ethtool

# Or create a wrapper script to prevent -x option on sfc interfaces
# Monitor for sfc driver issues in system logs
dmesg | grep -i "sfc\|rss_lock\|hung_task"