{"id":"CVE-2025-40347","state":"PUBLISHED","title":"net: enetc: fix the deadlock of enetc_mdio_lock","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: enetc: fix the deadlock of enetc_mdio_lock\n\nAfter applying the workaround for err050089, the LS1028A platform\nexperiences RCU stalls on RT kernel. This issue is caused by the\nrecursive acquisition of the read lock enetc_mdio_lock. Here list some\nof the call stacks identified under the enetc_poll path that may lead to\na deadlock:\n\nenetc_poll\n  -> enetc_lock_mdio\n  -> enetc_clean_rx_ring OR napi_complete_done\n     -> napi_gro_receive\n        -> enetc_start_xmit\n           -> enetc_lock_mdio\n           -> enetc_map_tx_buffs\n           -> enetc_unlock_mdio\n  -> enetc_unlock_mdio\n\nAfter enetc_poll acquires the read lock, a higher-priority writer attempts\nto acquire the lock, causing preemption. The writer detects that a\nread lock is already held and is scheduled out. However, readers under\nenetc_poll cannot acquire the read lock again because a writer is already\nwaiting, leading to a thread hang.\n\nCurrently, the deadlock is avoided by adjusting enetc_lock_mdio to prevent\nrecursive lock acquisition.","publishedAt":"2025-12-16T13:30:21.539Z","updatedAt":"2026-08-05T12:09:48.141Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"6d36ecdbc4410e61a0e02adc5d3abeee22a8ffd3","status":"affected","lessThan":"a649161526736f48bcc592e3a412e5bcd7dd9e24","versionType":"git"},{"version":"6d36ecdbc4410e61a0e02adc5d3abeee22a8ffd3","status":"affected","lessThan":"2781ca82ce8cad263d80b617addb727e6a84c9e5","versionType":"git"},{"version":"6d36ecdbc4410e61a0e02adc5d3abeee22a8ffd3","status":"affected","lessThan":"1f92f5bd057a4fad9dab6af17963cdd21e5da6ed","versionType":"git"},{"version":"6d36ecdbc4410e61a0e02adc5d3abeee22a8ffd3","status":"affected","lessThan":"2e55a49dc3b2a6b23329e4fbbd8a5feb20e220aa","versionType":"git"},{"version":"6d36ecdbc4410e61a0e02adc5d3abeee22a8ffd3","status":"affected","lessThan":"50bd33f6b3922a6b760aa30d409cae891cec8fb5","versionType":"git"},{"version":"bf9c564716a13dde6a990d3b02c27cd6e39608bf","status":"affected","versionType":"git"},{"version":"ff966263f5f9fdf9740f03fed0762ce73c230a6a","status":"affected","versionType":"git"},{"version":"5.10.24","status":"affected","lessThan":"5.11","versionType":"semver"},{"version":"5.11.7","status":"affected","lessThan":"5.12","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/freescale/enetc/enetc.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.12","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.12","versionType":"semver"},{"version":"6.1.175","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.115","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.56","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.17.6","status":"unaffected","lessThanOrEqual":"6.17.*","versionType":"semver"},{"version":"6.18","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/freescale/enetc/enetc.c"]}],"references":["https://git.kernel.org/stable/c/a649161526736f48bcc592e3a412e5bcd7dd9e24","https://git.kernel.org/stable/c/2781ca82ce8cad263d80b617addb727e6a84c9e5","https://git.kernel.org/stable/c/1f92f5bd057a4fad9dab6af17963cdd21e5da6ed","https://git.kernel.org/stable/c/2e55a49dc3b2a6b23329e4fbbd8a5feb20e220aa","https://git.kernel.org/stable/c/50bd33f6b3922a6b760aa30d409cae891cec8fb5"],"weaknesses":[],"ingestedAt":"2026-10-29T20:09:09.358Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/40xxx/CVE-2025-40347.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-40347","state":"PUBLISHED","datePublished":"2025-12-16T13:30:21.539Z","dateUpdated":"2026-08-05T12:09:48.141Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-04-16T07:20:57.187Z"},"containers":{"cna":{"title":"net: enetc: fix the deadlock of enetc_mdio_lock","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: enetc: fix the deadlock of enetc_mdio_lock\n\nAfter applying the workaround for err050089, the LS1028A platform\nexperiences RCU stalls on RT kernel. This issue is caused by the\nrecursive acquisition of the read lock enetc_mdio_lock. Here list some\nof the call stacks identified under the enetc_poll path that may lead to\na deadlock:\n\nenetc_poll\n  -> enetc_lock_mdio\n  -> enetc_clean_rx_ring OR napi_complete_done\n     -> napi_gro_receive\n        -> enetc_start_xmit\n           -> enetc_lock_mdio\n           -> enetc_map_tx_buffs\n           -> enetc_unlock_mdio\n  -> enetc_unlock_mdio\n\nAfter enetc_poll acquires the read lock, a higher-priority writer attempts\nto acquire the lock, causing preemption. The writer detects that a\nread lock is already held and is scheduled out. However, readers under\nenetc_poll cannot acquire the read lock again because a writer is already\nwaiting, leading to a thread hang.\n\nCurrently, the deadlock is avoided by adjusting enetc_lock_mdio to prevent\nrecursive lock acquisition."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"6d36ecdbc4410e61a0e02adc5d3abeee22a8ffd3","status":"affected","lessThan":"a649161526736f48bcc592e3a412e5bcd7dd9e24","versionType":"git"},{"version":"6d36ecdbc4410e61a0e02adc5d3abeee22a8ffd3","status":"affected","lessThan":"2781ca82ce8cad263d80b617addb727e6a84c9e5","versionType":"git"},{"version":"6d36ecdbc4410e61a0e02adc5d3abeee22a8ffd3","status":"affected","lessThan":"1f92f5bd057a4fad9dab6af17963cdd21e5da6ed","versionType":"git"},{"version":"6d36ecdbc4410e61a0e02adc5d3abeee22a8ffd3","status":"affected","lessThan":"2e55a49dc3b2a6b23329e4fbbd8a5feb20e220aa","versionType":"git"},{"version":"6d36ecdbc4410e61a0e02adc5d3abeee22a8ffd3","status":"affected","lessThan":"50bd33f6b3922a6b760aa30d409cae891cec8fb5","versionType":"git"},{"version":"bf9c564716a13dde6a990d3b02c27cd6e39608bf","status":"affected","versionType":"git"},{"version":"ff966263f5f9fdf9740f03fed0762ce73c230a6a","status":"affected","versionType":"git"},{"version":"5.10.24","status":"affected","lessThan":"5.11","versionType":"semver"},{"version":"5.11.7","status":"affected","lessThan":"5.12","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/freescale/enetc/enetc.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.12","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.12","versionType":"semver"},{"version":"6.1.175","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.115","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.56","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.17.6","status":"unaffected","lessThanOrEqual":"6.17.*","versionType":"semver"},{"version":"6.18","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/freescale/enetc/enetc.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/a649161526736f48bcc592e3a412e5bcd7dd9e24"},{"url":"https://git.kernel.org/stable/c/2781ca82ce8cad263d80b617addb727e6a84c9e5"},{"url":"https://git.kernel.org/stable/c/1f92f5bd057a4fad9dab6af17963cdd21e5da6ed"},{"url":"https://git.kernel.org/stable/c/2e55a49dc3b2a6b23329e4fbbd8a5feb20e220aa"},{"url":"https://git.kernel.org/stable/c/50bd33f6b3922a6b760aa30d409cae891cec8fb5"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - The deadlock is driven from the enetc RX datapath (`enetc_poll` → `napi_gro_receive` → stack → `enetc_start_xmit`), reached purely by packets arriving on the Ethernet interface, including routed IP traffic from arbitrary remote networks. No L2 adjacency or local access is needed — a plain ICMP/TCP flow that elicits a reply or is forwarded suffices.\nAC:L - The attacker directly creates the recursive read-lock condition by sustaining inbound traffic that triggers a transmit from within the RX softirq, and the competing MDIO writer occurs many times per second from the periodic phylib/phylink state machine, so the collision is reached reliably within seconds and can be retried indefinitely.\nPR:N - The vulnerable path is the unauthenticated packet-receive path of the NIC driver; no credentials, capabilities, or local account are required — merely sending traffic to (or through) the affected interface is enough.\nUI:N - No victim action is needed; the deadlock arises from normal kernel-side packet processing and background PHY polling that run without any user involvement.\nS:U - The lock inversion hangs kernel threads within the same security authority as the affected kernel; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - This is a pure lock-ordering/recursion defect with no memory corruption, out-of-bounds access, or exposure of kernel data to the attacker.\nI:N - No data is modified and no write primitive is produced; the failure mode is threads blocking on an rt_mutex-backed rwlock, not memory corruption.\nA:H - The recursive read-lock acquisition deadlocks the NAPI poll thread against a waiting MDIO writer, producing RCU stalls, hung tasks, and permanent loss of network processing on the interface — a remotely inducible, unrecoverable denial of service."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T12:09:48.141Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.12","versionEndExcluding":"6.1.175"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.12","versionEndExcluding":"6.6.115"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.12","versionEndExcluding":"6.12.56"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.12","versionEndExcluding":"6.17.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.12","versionEndExcluding":"6.18"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10.24"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11.7"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}