CVE-2026-45849 Overview
CVE-2026-45849 affects the Linux kernel net: mscc: ocelot driver. The function ocelot_port_xmit_inj() calls ocelot_can_inject() and ocelot_port_inject_frame() without holding the injection group lock. Both downstream functions contain lockdep_assert_held() checks for the injection lock, which trigger lockdep warnings when the lock is absent. The correct caller felix_port_deferred_xmit() properly acquires the lock via ocelot_lock_inj_grp() before invoking these helpers. The defect represents a concurrency flaw in the register injection transmit path of the Microsemi Ocelot Ethernet switch driver.
Critical Impact
Concurrent access to the injection group registers without synchronization can lead to lockdep assertion failures and potential race conditions in packet transmission on Ocelot-based switch hardware.
Affected Products
- Linux kernel net/ethernet/mscc/ocelot driver
- Microsemi Ocelot Ethernet switch hardware using the register-based injection path
- Felix DSA switch driver consumers of the ocelot library
Discovery Timeline
- 2026-05-27 - CVE-2026-45849 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-45849
Vulnerability Analysis
The defect resides in ocelot_port_xmit_inj() within the Microsemi mscc-ocelot network driver. This function dispatches frames through the CPU injection registers of the Ocelot switch fabric. It invokes ocelot_can_inject() to verify queue availability and then ocelot_port_inject_frame() to write the frame into the injection group registers.
Both helper functions declare lockdep_assert_held() on the injection group lock. The assertion exists because the injection group registers are shared state accessed from multiple transmit contexts. When ocelot_port_xmit_inj() calls these helpers without first acquiring the lock, lockdep reports the violation and the underlying register sequence is no longer serialized.
The sibling caller felix_port_deferred_xmit() demonstrates the intended pattern. It calls ocelot_lock_inj_grp() before frame injection and ocelot_unlock_inj_grp() afterward. The fix applies the same wrapping around the register injection path inside ocelot_port_xmit_inj(). The Frame Direct Memory Access (FDMA) path is unaffected because it uses its own locking mechanism.
Root Cause
The root cause is a missing synchronization primitive in the register-based transmit path [CWE category: Race Condition]. The injection group lock protects sequenced register writes that compose a single frame on the wire. Omitting acquisition allows two CPUs to interleave writes into the same injection group, corrupting the frame stream or violating the driver's documented locking contract enforced by lockdep_assert_held().
Attack Vector
Exploitation requires local kernel-mode execution paths on systems using Ocelot or Felix switch hardware. The flaw is triggered when transmit contexts run concurrently across CPUs on the same injection group. There are no known remote attack vectors. The practical effect is kernel lockdep splats, possible frame corruption on the injection group, and undefined behavior in multi-CPU transmit scenarios.
No public proof-of-concept exploit code exists. The vulnerability is described in the upstream commit messages referenced by the Kernel Stable Commit 026f6513 and related backports.
Detection Methods for CVE-2026-45849
Indicators of Compromise
- Lockdep warning messages in dmesg referencing ocelot_can_inject or ocelot_port_inject_frame with lockdep_assert_held violations
- Unexpected transmit errors, dropped frames, or malformed packets on switch ports backed by the mscc-ocelot register injection path
- Kernel WARN_ON stack traces originating in ocelot_port_xmit_inj()
Detection Strategies
- Audit running kernel versions against the fixed commits listed in the upstream stable tree references
- Enable CONFIG_PROVE_LOCKING and CONFIG_DEBUG_LOCKDEP on test systems to surface the missing-lock condition during transmit load
- Correlate kernel log anomalies with workload spikes on ports served by Ocelot or Felix switch drivers
Monitoring Recommendations
- Forward kernel ring buffer logs to a centralized log platform and alert on lockdep and WARN events that reference the ocelot driver
- Track network interface counters for unexpected TX errors on switch ports using the register injection path
- Monitor distribution kernel advisories for stable backport availability across LTS branches
How to Mitigate CVE-2026-45849
Immediate Actions Required
- Update affected systems to a kernel build that includes the upstream fix adding ocelot_lock_inj_grp() and ocelot_unlock_inj_grp() around the register injection path
- Inventory embedded and networking devices using Microsemi Ocelot or Felix switch silicon and confirm their kernel branch
- Apply the relevant stable backport from the kernel.org references for the deployed LTS series
Patch Information
The fix is committed to the Linux stable tree and backported across multiple branches. Reference the following commits for the appropriate kernel series: Kernel Stable Commit 026f6513, Kernel Stable Commit 0b217a4, Kernel Stable Commit 51c32ae7, Kernel Stable Commit 63da9613, Kernel Stable Commit 7ac58d88, and Kernel Stable Commit cc1b179f.
Workarounds
- Where supported by the platform, route transmit traffic through the FDMA path, which uses an independent locking mechanism and is not affected
- Restrict concurrent transmit workloads on Ocelot-backed interfaces until a patched kernel is installed
- Disable lockdep panics on production systems only after confirming a patch deployment plan, since suppressing warnings does not remove the underlying race
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
