CVE-2026-45907

The record

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix deadlocks between devlink and netdev instance locks In the mentioned "Fixes" commit, various work tasks triggering devlink health reporter recovery were switched to use netdev_trylock to protect against concurrent tear down of the channels being recovered. But this had the side effect of introducing potential deadlocks because of incorrect lock ordering. The correct lock order is described by the init flow: probe_one -> mlx5_init_one (acquires devlink lock) -> mlx5_init_one_devl_locked -> mlx5_register_device -> mlx5_rescan_drivers_locked -...-> mlx5e_probe -> _mlx5e_probe -> register_netdev (acquires rtnl lock) -> register_netdevice (acquires netdev lock) => devlink lock -> rtnl lock -> netdev lock. But in the current recovery flow, the order is wrong: mlx5e_tx_err_cqe_work (acquires netdev lock) -> mlx5e_reporter_tx_err_cqe -> mlx5e_health_report -> devlink_health_report (acquires devlink lock => boom!) -> devlink_health_reporter_recover -> mlx5e_tx_reporter_recover -> mlx5e_tx_reporter_recover_from_ctx -> mlx5e_tx_reporter_err_cqe_recover The same pattern exists in: mlx5e_reporter_rx_timeout mlx5e_reporter_tx_ptpsq_unhealthy mlx5e_reporter_tx_timeout Fix these by moving the netdev_trylock calls from the work handlers lower in the call stack, in the respective recovery functions, where they are actually necessary.

Affected packages

Related vulnerabilities

• CVE-2026-61854 VoiceSentinel is a real-time voice moderation system for Minecraft servers. CWE-667
• CVE-2026-118593 A flaw was found in Red Hat Enterprise Linux 9 kernel builds. CWE-667
• CVE-2026-106174 A improper locking vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.4 through 7.6.6… CWE-667
• CVE-2026-110803 VaadinService.requestEnd() in Vaadin Framework 8 locks the session and then reads the… CWE-667
• CVE-2026-111879 DBI versions before 1.656 for Perl hang on a later open of a DBD::DBM table because a… CWE-667
• CVE-2026-107674 IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to a denial of service to Digital Certificate… CWE-667
• CVE-2026-98123 In the Linux kernel, the following vulnerability has been resolved: sctp: fix soft lockup… CWE-667
• CVE-2026-98094 In the Linux kernel, the following vulnerability has been resolved: staging: fbtft: make… CWE-667