CVE-2026-53323: Linux Kernel DSA Ethtool DoS Vulnerability

CVE-2026-53323 Overview

CVE-2026-53323 is a Linux kernel vulnerability in the Distributed Switch Architecture (DSA) subsystem. The flaw resides in the conduit (master) device's ethtool_ops wrappers, which DSA replaces to aggregate statistics from both the conduit interface and its DSA switch ports. Redundant calls to netdev_lock_ops() inside these wrappers cause the locking primitive to recurse and produce a deadlock. A local user issuing an ethtool -i query against an affected interface can trigger the condition. The issue was reproduced when booting QEMU with the fbnic driver and CONFIG_NET_DSA_LOOP=y. Maintainers have resolved the issue by removing the redundant netdev_lock_ops()/netdev_unlock_ops() calls from the DSA conduit ethtool wrappers.

Critical Impact
Local users can trigger a kernel deadlock in the DSA conduit ethtool path via a simple ethtool query, causing denial of service on affected networking hardware.

Affected Products

Linux kernel builds with DSA (Distributed Switch Architecture) enabled
Systems using conduit (master) network devices with real ops-locked drivers such as fbnic
Kernel configurations enabling CONFIG_NET_DSA_LOOP=y

Discovery Timeline

2026-06-26 - CVE-2026-53323 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-53323

Vulnerability Analysis

DSA is a Linux kernel subsystem that supports Ethernet switch chips connected to a host CPU through a conduit interface. To surface unified statistics, DSA overrides the conduit device's ethtool_ops with wrappers that combine counters from the conduit and each switch port. Recent kernel changes introduced netdev_lock_ops() in the generic ethtool call path to serialize operations on ops-locked devices. The DSA wrappers duplicated this locking, so the wrapper acquired the lock a second time while the outer ethtool caller still held it. Any userspace tool invoking ethtool commands, including ethtool -i, deadlocks the calling thread against the conduit's operation lock.

Root Cause

The root cause is redundant lock acquisition in the DSA conduit ethtool wrappers. Both the generic ethtool entry point and the DSA wrappers called netdev_lock_ops() on the same conduit device. This double-lock pattern is a classic deadlock [CWE-667] introduced when the outer locking was added without pruning the inner calls from DSA. Testing coverage for ops-locked conduit drivers was effectively absent, allowing the regression to reach mainline.

Attack Vector

Exploitation requires local access to a system where DSA is bound on top of an ops-locked conduit driver. An unprivileged process running an ethtool query against the conduit interface deadlocks the kernel worker handling the request. The impact is a denial of service on the networking stack for that device. Remote exploitation is not applicable, and no code execution or information disclosure results from the flaw.

No public exploit code is required to reproduce the condition. The vulnerability manifests through normal use of ethtool against a conduit interface. See the referenced kernel commits for the patch diff and technical detail.

Detection Methods for CVE-2026-53323

Indicators of Compromise

Kernel hung task warnings referencing netdev_lock_ops in the call stack on DSA conduit interfaces
ethtool processes stuck in uninterruptible sleep (D state) when querying a DSA-managed interface
Soft lockup or RCU stall messages associated with ethtool ioctl handlers on switch-attached NICs

Detection Strategies

Monitor dmesg and journal logs for INFO: task ethtool: blocked and lock debugging traces involving DSA wrappers
Correlate kernel version and build config (CONFIG_NET_DSA, CONFIG_NET_DSA_LOOP) against affected commit ranges referenced in the Linux stable tree
Run reproducibility checks in staging environments by executing ethtool -i <conduit> and observing for hangs

Monitoring Recommendations

Enable CONFIG_LOCKDEP and CONFIG_PROVE_LOCKING on test kernels to surface recursive lock acquisitions early
Track kernel package versions across the fleet and alert on hosts running kernels missing the fix commits 0f99e0c3e19b, 74d64ae4254e, and abe91fd04587
Alert on repeated hung-task detector warnings tied to network management processes

How to Mitigate CVE-2026-53323

Immediate Actions Required

Update to a Linux kernel that includes the fix commits referenced in the Linux stable tree
Restrict local access to management utilities that invoke ethtool on DSA conduit interfaces until patches are applied
Reboot affected systems after applying the kernel update to ensure the fixed module is loaded

Patch Information

The upstream fix removes the redundant netdev_lock_ops() and netdev_unlock_ops() calls from the DSA conduit ethtool wrappers. The relevant stable-tree commits are 0f99e0c3e19b, 74d64ae4254e, and abe91fd04587. Apply distribution-provided kernel updates as they become available.

Workarounds

Disable DSA where not required by removing CONFIG_NET_DSA or unloading DSA modules on affected hosts
Avoid running ethtool queries against conduit interfaces bound to ops-locked drivers such as fbnic until the patch is deployed
Rebuild custom kernels without CONFIG_NET_DSA_LOOP in production images to reduce exposure to the test path that surfaced the issue

bash

# Verify kernel includes the DSA conduit ethtool fix
uname -r
git -C /usr/src/linux log --oneline | grep -E "0f99e0c3e19b|74d64ae4254e|abe91fd04587"

# Temporarily unload DSA loopback module if present
sudo modprobe -r dsa_loop