CVE-2026-45849

net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj()

published May 27, 2026

CVSS
—
EPSS
0%
Percentile
3.2
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj()

ocelot_port_xmit_inj() calls ocelot_can_inject() and

ocelot_port_inject_frame() without holding the injection group lock.

Both functions contain lockdep_assert_held() for the injection lock,

and the correct caller felix_port_deferred_xmit() properly acquires

the lock using ocelot_lock_inj_grp() before calling these functions.

Add ocelot_lock_inj_grp()/ocelot_unlock_inj_grp() around the register

injection path to fix the missing lock protection. The FDMA path is not

affected as it uses its own locking mechanism.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00142 · 3.2th percentile
Published
2026-05-27T12:15Z
EPSS history
Timeline
  • 27 MAY 12:15Z
    net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj()
    cvelistv5