CVE-2026-45907

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the net/mlx5e component where incorrect lock ordering leads to potential deadlocks between devlink and netdev instance locks. This occurs during devlink health reporter recovery when work tasks use netdev trylock to prevent concurrent tear down of channels. The incorrect sequence is triggered in functions such as mlx5e tx err cqe work(), mlx5e reporter rx timeout(), mlx5e reporter tx ptpsq unhealthy(), and mlx5e reporter tx timeout(), where the netdev lock is acquired before the devlink lock, contradicting the required order of devlink lock, then rtnl lock, and finally netdev lock.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.