CVE-2026-80999: Linux Kernel DSA Realtek Race Condition

CVE-2026-80999 Overview

CVE-2026-80999 affects the Linux kernel's Realtek Distributed Switch Architecture (DSA) driver. The driver called gpiod_set_value() on the reset General-Purpose Input/Output (GPIO) line during probe. When the reset GPIO is provided by a sleeping controller such as an Inter-Integrated Circuit (I2C) I/O expander, this triggers a kernel warning at drivers/gpio/gpiolib.c:4030.

The issue is a correctness defect in the rtl83xx_reset_assert() and rtl83xx_reset_deassert() helpers introduced in kernel v6.9. The fix switches both helpers to gpiod_set_value_cansleep().

Critical Impact
The flaw produces a kernel WARNING splat during device probe on affected hardware. It does not enable remote exploitation, but it can obscure real driver faults and complicate diagnostics on Realtek DSA switch platforms.

Affected Products

Linux kernel v6.9 and later containing the rtl83xx_reset_assert() and rtl83xx_reset_deassert() helpers
Systems using the net/dsa/realtek driver with a sleeping-controller reset GPIO (for example, I2C I/O expanders)
Older stable kernels (pre-v6.9) at the corresponding open-coded call sites in realtek-smi.c and realtek-mdio.c

Discovery Timeline

2026-09-11 - CVE-2026-80999 published to the National Vulnerability Database (NVD)
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-80999

Vulnerability Analysis

The Realtek DSA driver drives its hardware reset line during the probe path. The probe path is allowed to sleep and is not timing-critical. The original code used gpiod_set_value(), which assumes the underlying GPIO controller can complete the operation without sleeping.

When the reset GPIO is routed through a sleeping controller, the GPIO library emits a WARNING from gpiod_set_value+0x44/0x80 during rtl83xx_probe. The call chain traverses realtek_mdio_probe, mdio_probe, and the deferred probe worker deferred_probe_work_func. Affected hardware includes platforms such as the referenced B&O MAP CA33 board.

While the warning does not corrupt memory or grant privileges, it can suppress reliable probe behavior expectations and flood logs on affected boards. Repeated warnings during deferred probe can also mask other kernel diagnostics.

Root Cause

The root cause is an incorrect GPIO Application Programming Interface (API) choice for a sleepable context. gpiod_set_value() must only be used when the GPIO controller can respond without sleeping. The Realtek DSA reset helpers run in the probe path, where sleeping is permitted, so they must use gpiod_set_value_cansleep() to support I2C-backed or Serial Peripheral Interface (SPI)-backed GPIO expanders.

Attack Vector

The defect is not remotely exploitable and requires no attacker interaction. It is triggered locally by the kernel itself during driver initialization on hardware where the reset GPIO is provided by a sleeping controller. The issue manifests only at boot or module load time on affected Realtek DSA switch platforms.

No verified proof-of-concept code is required to reproduce the warning. The upstream commit description in the Kernel Git Commit fb58b6a contains the full call trace observed during deferred_probe_work_func.

Detection Methods for CVE-2026-80999

Indicators of Compromise

Kernel log entries containing WARNING: drivers/gpio/gpiolib.c:4030 at gpiod_set_value+0x44/0x80 during boot or module load
Call trace referencing rtl83xx_probe, realtek_mdio_probe, and deferred_probe_work_func
Warnings emitted from the events_unbound workqueue on systems using Realtek DSA switches with I2C or SPI GPIO expanders

Detection Strategies

Grep kernel ring buffer output (dmesg) for gpiod_set_value warnings paired with rtl83xx symbols
Monitor systemd journal entries for WARN_ON splats originating in the DSA subsystem during device enumeration
Verify the running kernel version against the fixed commits referenced by the stable maintainers

Monitoring Recommendations

Forward kernel logs from embedded network devices to a central log aggregator and alert on gpiolib warnings
Track kernel version inventory across Realtek-based switch appliances to prioritize patch rollout
Include probe-time kernel warnings in device health baselines to distinguish this defect from unrelated hardware faults

How to Mitigate CVE-2026-80999

Immediate Actions Required

Apply the upstream stable-tree patches that convert rtl83xx_reset_assert() and rtl83xx_reset_deassert() to gpiod_set_value_cansleep()
Identify systems using Realtek DSA switches with reset GPIOs provided by sleeping controllers such as I2C I/O expanders
For pre-v6.9 kernels, apply the equivalent conversion at the open-coded call sites in realtek-smi.c and realtek-mdio.c

Patch Information

Fixes are available across stable branches. Reference the upstream commits: Kernel Git Commit 1610a8c, Kernel Git Commit c32cf52, Kernel Git Commit f71087e, and Kernel Git Commit fb58b6a.

Workarounds

Where feasible, wire the reset line to a non-sleeping GPIO controller until the patched kernel is deployed
Suppress non-actionable warnings only after confirming they map to this defect and not to unrelated GPIO faults
Rebuild affected kernels from source with the stable patch backported for platforms that lack vendor kernel updates

bash

# Verify running kernel and check for the warning signature
uname -r
dmesg | grep -E 'gpiod_set_value|rtl83xx_probe'