GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-40347 (GCVE-0-2025-40347)

Vulnerability from cvelistv5 – Published: 2025-12-16 13:30 – Updated: 2026-08-05 12:09
VLAI
Title
net: enetc: fix the deadlock of enetc_mdio_lock
Summary
In the Linux kernel, the following vulnerability has been resolved: net: enetc: fix the deadlock of enetc_mdio_lock After applying the workaround for err050089, the LS1028A platform experiences RCU stalls on RT kernel. This issue is caused by the recursive acquisition of the read lock enetc_mdio_lock. Here list some of the call stacks identified under the enetc_poll path that may lead to a deadlock: enetc_poll -> enetc_lock_mdio -> enetc_clean_rx_ring OR napi_complete_done -> napi_gro_receive -> enetc_start_xmit -> enetc_lock_mdio -> enetc_map_tx_buffs -> enetc_unlock_mdio -> enetc_unlock_mdio After enetc_poll acquires the read lock, a higher-priority writer attempts to acquire the lock, causing preemption. The writer detects that a read lock is already held and is scheduled out. However, readers under enetc_poll cannot acquire the read lock again because a writer is already waiting, leading to a thread hang. Currently, the deadlock is avoided by adjusting enetc_lock_mdio to prevent recursive lock acquisition.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 6d36ecdbc4410e61a0e02adc5d3abeee22a8ffd3 , < a649161526736f48bcc592e3a412e5bcd7dd9e24 (git)
Affected: 6d36ecdbc4410e61a0e02adc5d3abeee22a8ffd3 , < 2781ca82ce8cad263d80b617addb727e6a84c9e5 (git)
Affected: 6d36ecdbc4410e61a0e02adc5d3abeee22a8ffd3 , < 1f92f5bd057a4fad9dab6af17963cdd21e5da6ed (git)
Affected: 6d36ecdbc4410e61a0e02adc5d3abeee22a8ffd3 , < 2e55a49dc3b2a6b23329e4fbbd8a5feb20e220aa (git)
Affected: 6d36ecdbc4410e61a0e02adc5d3abeee22a8ffd3 , < 50bd33f6b3922a6b760aa30d409cae891cec8fb5 (git)
Affected: bf9c564716a13dde6a990d3b02c27cd6e39608bf (git)
Affected: ff966263f5f9fdf9740f03fed0762ce73c230a6a (git)
Affected: 5.10.24 , < 5.11 (semver)
Affected: 5.11.7 , < 5.12 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.12
Unaffected: 0 , < 5.12 (semver)
Unaffected: 6.1.175 , ≤ 6.1.* (semver)
Unaffected: 6.6.115 , ≤ 6.6.* (semver)
Unaffected: 6.12.56 , ≤ 6.12.* (semver)
Unaffected: 6.17.6 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/freescale/enetc/enetc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a649161526736f48bcc592e3a412e5bcd7dd9e24",
              "status": "affected",
              "version": "6d36ecdbc4410e61a0e02adc5d3abeee22a8ffd3",
              "versionType": "git"
            },
            {
              "lessThan": "2781ca82ce8cad263d80b617addb727e6a84c9e5",
              "status": "affected",
              "version": "6d36ecdbc4410e61a0e02adc5d3abeee22a8ffd3",
              "versionType": "git"
            },
            {
              "lessThan": "1f92f5bd057a4fad9dab6af17963cdd21e5da6ed",
              "status": "affected",
              "version": "6d36ecdbc4410e61a0e02adc5d3abeee22a8ffd3",
              "versionType": "git"
            },
            {
              "lessThan": "2e55a49dc3b2a6b23329e4fbbd8a5feb20e220aa",
              "status": "affected",
              "version": "6d36ecdbc4410e61a0e02adc5d3abeee22a8ffd3",
              "versionType": "git"
            },
            {
              "lessThan": "50bd33f6b3922a6b760aa30d409cae891cec8fb5",
              "status": "affected",
              "version": "6d36ecdbc4410e61a0e02adc5d3abeee22a8ffd3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "bf9c564716a13dde6a990d3b02c27cd6e39608bf",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ff966263f5f9fdf9740f03fed0762ce73c230a6a",
              "versionType": "git"
            },
            {
              "lessThan": "5.11",
              "status": "affected",
              "version": "5.10.24",
              "versionType": "semver"
            },
            {
              "lessThan": "5.12",
              "status": "affected",
              "version": "5.11.7",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/freescale/enetc/enetc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.12"
            },
            {
              "lessThan": "5.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.115",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.56",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.115",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.56",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.6",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.10.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.11.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: enetc: fix the deadlock of enetc_mdio_lock\n\nAfter applying the workaround for err050089, the LS1028A platform\nexperiences RCU stalls on RT kernel. This issue is caused by the\nrecursive acquisition of the read lock enetc_mdio_lock. Here list some\nof the call stacks identified under the enetc_poll path that may lead to\na deadlock:\n\nenetc_poll\n  -\u003e enetc_lock_mdio\n  -\u003e enetc_clean_rx_ring OR napi_complete_done\n     -\u003e napi_gro_receive\n        -\u003e enetc_start_xmit\n           -\u003e enetc_lock_mdio\n           -\u003e enetc_map_tx_buffs\n           -\u003e enetc_unlock_mdio\n  -\u003e enetc_unlock_mdio\n\nAfter enetc_poll acquires the read lock, a higher-priority writer attempts\nto acquire the lock, causing preemption. The writer detects that a\nread lock is already held and is scheduled out. However, readers under\nenetc_poll cannot acquire the read lock again because a writer is already\nwaiting, leading to a thread hang.\n\nCurrently, the deadlock is avoided by adjusting enetc_lock_mdio to prevent\nrecursive lock acquisition."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The deadlock is driven from the enetc RX datapath (`enetc_poll` \u2192 `napi_gro_receive` \u2192 stack \u2192 `enetc_start_xmit`), reached purely by packets arriving on the Ethernet interface, including routed IP traffic from arbitrary remote networks. No L2 adjacency or local access is needed \u2014 a plain ICMP/TCP flow that elicits a reply or is forwarded suffices.\nAC:L - The attacker directly creates the recursive read-lock condition by sustaining inbound traffic that triggers a transmit from within the RX softirq, and the competing MDIO writer occurs many times per second from the periodic phylib/phylink state machine, so the collision is reached reliably within seconds and can be retried indefinitely.\nPR:N - The vulnerable path is the unauthenticated packet-receive path of the NIC driver; no credentials, capabilities, or local account are required \u2014 merely sending traffic to (or through) the affected interface is enough.\nUI:N - No victim action is needed; the deadlock arises from normal kernel-side packet processing and background PHY polling that run without any user involvement.\nS:U - The lock inversion hangs kernel threads within the same security authority as the affected kernel; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - This is a pure lock-ordering/recursion defect with no memory corruption, out-of-bounds access, or exposure of kernel data to the attacker.\nI:N - No data is modified and no write primitive is produced; the failure mode is threads blocking on an rt_mutex-backed rwlock, not memory corruption.\nA:H - The recursive read-lock acquisition deadlocks the NAPI poll thread against a waiting MDIO writer, producing RCU stalls, hung tasks, and permanent loss of network processing on the interface \u2014 a remotely inducible, unrecoverable denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:09:48.141Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a649161526736f48bcc592e3a412e5bcd7dd9e24"
        },
        {
          "url": "https://git.kernel.org/stable/c/2781ca82ce8cad263d80b617addb727e6a84c9e5"
        },
        {
          "url": "https://git.kernel.org/stable/c/1f92f5bd057a4fad9dab6af17963cdd21e5da6ed"
        },
        {
          "url": "https://git.kernel.org/stable/c/2e55a49dc3b2a6b23329e4fbbd8a5feb20e220aa"
        },
        {
          "url": "https://git.kernel.org/stable/c/50bd33f6b3922a6b760aa30d409cae891cec8fb5"
        }
      ],
      "title": "net: enetc: fix the deadlock of enetc_mdio_lock",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40347",
    "datePublished": "2025-12-16T13:30:21.539Z",
    "dateReserved": "2025-04-16T07:20:57.187Z",
    "dateUpdated": "2026-08-05T12:09:48.141Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-40347",
      "date": "2026-09-16",
      "epss": "0.00528",
      "percentile": "0.43385"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-40347\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-16T14:15:46.470\",\"lastModified\":\"2026-07-30T06:24:30.637\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: enetc: fix the deadlock of enetc_mdio_lock\\n\\nAfter applying the workaround for err050089, the LS1028A platform\\nexperiences RCU stalls on RT kernel. This issue is caused by the\\nrecursive acquisition of the read lock enetc_mdio_lock. Here list some\\nof the call stacks identified under the enetc_poll path that may lead to\\na deadlock:\\n\\nenetc_poll\\n  -\u003e enetc_lock_mdio\\n  -\u003e enetc_clean_rx_ring OR napi_complete_done\\n     -\u003e napi_gro_receive\\n        -\u003e enetc_start_xmit\\n           -\u003e enetc_lock_mdio\\n           -\u003e enetc_map_tx_buffs\\n           -\u003e enetc_unlock_mdio\\n  -\u003e enetc_unlock_mdio\\n\\nAfter enetc_poll acquires the read lock, a higher-priority writer attempts\\nto acquire the lock, causing preemption. The writer detects that a\\nread lock is already held and is scheduled out. However, readers under\\nenetc_poll cannot acquire the read lock again because a writer is already\\nwaiting, leading to a thread hang.\\n\\nCurrently, the deadlock is avoided by adjusting enetc_lock_mdio to prevent\\nrecursive lock acquisition.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/freescale/enetc/enetc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6d36ecdbc4410e61a0e02adc5d3abeee22a8ffd3\",\"lessThan\":\"a649161526736f48bcc592e3a412e5bcd7dd9e24\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6d36ecdbc4410e61a0e02adc5d3abeee22a8ffd3\",\"lessThan\":\"2781ca82ce8cad263d80b617addb727e6a84c9e5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6d36ecdbc4410e61a0e02adc5d3abeee22a8ffd3\",\"lessThan\":\"1f92f5bd057a4fad9dab6af17963cdd21e5da6ed\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6d36ecdbc4410e61a0e02adc5d3abeee22a8ffd3\",\"lessThan\":\"2e55a49dc3b2a6b23329e4fbbd8a5feb20e220aa\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6d36ecdbc4410e61a0e02adc5d3abeee22a8ffd3\",\"lessThan\":\"50bd33f6b3922a6b760aa30d409cae891cec8fb5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bf9c564716a13dde6a990d3b02c27cd6e39608bf\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ff966263f5f9fdf9740f03fed0762ce73c230a6a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.10.24\",\"lessThan\":\"5.11\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.11.7\",\"lessThan\":\"5.12\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/freescale/enetc/enetc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.175\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.115\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.56\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17.6\",\"lessThanOrEqual\":\"6.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1f92f5bd057a4fad9dab6af17963cdd21e5da6ed\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/2781ca82ce8cad263d80b617addb727e6a84c9e5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/2e55a49dc3b2a6b23329e4fbbd8a5feb20e220aa\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/50bd33f6b3922a6b760aa30d409cae891cec8fb5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a649161526736f48bcc592e3a412e5bcd7dd9e24\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-07-30T08:17:08+00:00",
      "cve": "CVE-2025-40347",
      "id": "CVE-2025-40347",
      "initial_release_date": "2025-12-16T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: enetc: fix the deadlock of enetc_mdio_lock",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40347.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-28T16:53:50Z",
      "cve": "CVE-2025-40347",
      "id": "CVE-2025-40347",
      "initial_release_date": "2025-12-17T00:30:38Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "683",
      "product_status:known_not_affected": "187",
      "product_status:recommended": "289",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-40347",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-40347.json",
      "version": "36"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.