Linux Kernel up to 7.0.12 net sfp_bus_add_upstream deadlock

Summaryinfo

A vulnerability has been found in Linux Kernel up to 7.0.12 and classified as critical. This affects the function sfp_bus_add_upstream of the component net. The manipulation leads to deadlock. This vulnerability is listed as CVE-2026-53231. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Linux Kernel up to 7.0.12. It has been rated as critical. This issue affects the function sfp_bus_add_upstream of the component net. The manipulation with an unknown input leads to a deadlock vulnerability. Using CWE to declare the problem leads to CWE-833. The product contains multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock. Impacted is availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: net: phy: don't try to setup PHY-driven SFP cages when using genphy We don't have support for PHY-driver SFP cages with the genphy code. On top of that, it was found by sashiko that running sfp_bus_add_upstream() for genphy deadlocks, as for genphy the PHY probing runs under RTNL, which isn't the case for non-genphy drivers. This problem was reproduced, and does lead to a deadlock on RTNL. Before the blamed commit, the phy_sfp_probe() call was made by individual PHY drivers, so there was no way to get to the SFP probing path when using genphy. Let's therefore only run phy_sfp_probe when not using genphy.

The advisory is shared at git.kernel.org. The identification of this vulnerability is CVE-2026-53231 since 06/09/2026. The exploitation is known to be difficult. Technical details are known, but no exploit is available.

Upgrading to version 7.0.13 eliminates this vulnerability. Applying the patch ef8d739eee6f85303cbecebc01eb72f063de74e0/5a0082ec20a05ef2378410323a5089a8f1786f4a is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.0.0
• 7.0.1
• 7.0.2
• 7.0.3
• 7.0.4
• 7.0.5
• 7.0.6
• 7.0.7
• 7.0.8
• 7.0.9
• 7.0.10
• 7.0.11
• 7.0.12

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion