CVE-2026-46031: Linux Kernel Race Condition Vulnerability

CVE-2026-46031 Overview

CVE-2026-46031 is a deadlock vulnerability in the Linux kernel's ks8851 Ethernet driver. The flaw occurs when the IRQ handler ks8851_irq() is executed while a TX packet is in flight. Under CONFIG_PREEMPT_RT=y, allocating SKBs through netdev_alloc_skb_ip_align() re-enables bottom halves, which schedules the TX softirq. The softirq invokes ks8851_start_xmit_par(), which attempts to acquire the ks8851_net_par.lock spinlock already held by the IRQ handler. The result is a kernel deadlock. The same condition can be triggered without an RX packet on non-PREEMPT_RT kernels after commit 0913ec336a6c0.

Critical Impact
A reachable spinlock deadlock in the network IRQ path stalls the affected CPU and the network interface, producing a localized denial-of-service on systems using the Micrel KS8851 Ethernet controller.

Affected Products

Linux kernel net/ethernet/micrel/ks8851 driver (parallel and SPI variants)
Kernel builds with CONFIG_PREEMPT_RT=y are most directly affected
Stable kernel branches addressed by commits 21f1707a, 51804032, 5c9fcac3, 640a7631, and be8aad55

Discovery Timeline

2026-05-27 - CVE-2026-46031 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-46031

Vulnerability Analysis

The ks8851 driver handles a hardware interrupt by acquiring the per-device statelock spinlock and processing both RX and TX events. When the driver receives packets, ks8851_rx_pkts() calls netdev_alloc_skb_ip_align() to allocate socket buffers for incoming frames.

On PREEMPT_RT kernels, netdev_alloc_skb_ip_align() ends with local_bh_enable(). Re-enabling bottom halves while a softirq is pending forces immediate softirq processing on the same thread. The pending net_tx_action() softirq then runs because the earlier call to netif_wake_queue() scheduled TX work.

The softirq path reaches dev_hard_start_xmit() and finally ks8851_start_xmit_par(), which attempts rt_spin_lock() on the same statelock already owned by the IRQ thread. The thread waits on itself, producing a self-deadlock. The captured stack trace shows the chain from __netdev_alloc_skb through handle_softirqs to ks8851_start_xmit_par.

Root Cause

The root cause is improper synchronization between the threaded IRQ handler and softirq-driven transmit processing. The handler holds a non-BH-safe spinlock across calls that internally enable bottom halves, allowing the TX softirq to re-enter the same locked region. This is a deadlock condition rooted in a missing local_bh_disable() boundary around the critical section.

Attack Vector

The condition is triggered by ordinary network traffic that produces simultaneous RX and TX activity on the KS8851 interface. An attacker with the ability to send sustained traffic to a host using this NIC can reliably induce the deadlock, freezing the affected CPU and disabling networking on the device. No authentication is required when the attacker is on the same network segment as the device.

The vulnerability is described in the upstream commit messages referenced by the kernel.org links. See the Kernel Git Commit 21f1707 for the fix narrative and stack trace.

Detection Methods for CVE-2026-46031

Indicators of Compromise

Kernel log entries referencing rtlock_slowlock_locked, ks8851_start_xmit_par, and ks8851_irq in the same stack trace.
Soft lockup or hung task warnings on systems using the Micrel KS8851 NIC.
Sudden loss of network connectivity on the affected interface accompanied by IRQ thread stalls.

Detection Strategies

Audit running kernel versions against the patched stable releases that include commits 21f1707a, 51804032, 5c9fcac3, 640a7631, or be8aad55.
Identify embedded and industrial devices that use the KS8851 parallel or SPI Ethernet controller, as these are the only impacted platforms.
Monitor dmesg and serial console output on PREEMPT_RT deployments for repeated lock-related backtraces involving the ks8851 symbols.

Monitoring Recommendations

Forward kernel ring buffer events to a centralized log pipeline and alert on BUG:, WARNING:, or hung task patterns referencing ks8851.
Track interface up/down events and TX queue stalls on KS8851 devices via SNMP or ethtool counters.
Correlate network availability dips with kernel panics or watchdog resets across fleets of identical embedded hardware.

How to Mitigate CVE-2026-46031

Immediate Actions Required

Apply the upstream kernel patches that disable bottom halves around the ks8851 IRQ handler and related critical sections.
Rebuild and deploy kernels for PREEMPT_RT and embedded Linux images that ship the ks8851 driver.
Inventory all devices using the Micrel KS8851 NIC, especially industrial control and embedded systems.

Patch Information

The issue is resolved by reinstating local_bh_disable()/local_bh_enable() around the IRQ handler and the locked sections in drivers/net/ethernet/micrel/ks8851_common.c. The fix is distributed across the following commits: Kernel Git Commit 21f1707, Kernel Git Commit 5180403, Kernel Git Commit 5c9fcac, Kernel Git Commit 640a763, and Kernel Git Commit be8aad5.

Workarounds

Disable CONFIG_PREEMPT_RT in kernel builds where real-time preemption is not required, which removes one of the trigger paths.
Reduce traffic load on KS8851 interfaces and avoid simultaneous heavy RX/TX flows until the patch is applied.
Where feasible, replace the KS8851 controller with an alternate NIC on critical real-time systems pending patch deployment.

bash

# Verify whether a running kernel contains the ks8851 fix
modinfo ks8851 | grep -E 'filename|version'
grep -E 'ks8851|PREEMPT_RT' /boot/config-$(uname -r)
dmesg | grep -i ks8851