PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45849 Linux CVE debrief

A missing lock protection vulnerability in the Linux kernel's MSCC Ocelot network driver could lead to race conditions during frame injection operations. The `ocelot_port_xmit_inj()` function calls `ocelot_can_inject()` and `ocelot_port_inject_frame()` without holding the required injection group lock, violating lockdep assertions present in both called functions. The correct caller `felix_port_deferred_xmit()` properly acquires this lock via `ocelot_lock_inj_grp()` before invoking these functions, indicating the missing synchronization in `ocelot_port_xmit_inj()` is an implementation error. The FDMA (Frame DMA) path is not affected as it employs independent locking mechanisms. This vulnerability was resolved by adding proper `ocelot_lock_inj_grp()`/`ocelot_unlock_inj_grp()` calls around the register injection path.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-25
Advisory published
2026-05-27
Advisory updated
2026-06-25

Who should care

Organizations running Linux systems with MSCC Ocelot network hardware (Microchip VSC7511/VSC7512/VSC7513/VSC7514 Ethernet switches) in production environments, particularly those with high-throughput networking requirements or custom kernel builds enabling this driver.

Technical summary

The MSCC Ocelot network driver in the Linux kernel contains a synchronization flaw where `ocelot_port_xmit_inj()` invokes `ocelot_can_inject()` and `ocelot_port_inject_frame()` without acquiring the injection group lock. Both target functions contain `lockdep_assert_held()` validations for this lock, which are violated by the unsynchronized caller. The fix adds proper `ocelot_lock_inj_grp()`/`ocelot_unlock_inj_grp()` protection around the register injection code path. The FDMA path remains unaffected due to separate locking. Multiple stable kernel tree backports are available.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates containing the referenced stable tree commits when available for your distribution
  • Verify kernel version includes fix commits: 026f6513c5880c2c89e38ad66bbec2868f978605, 0b217a40156f497e09dd20d3f7baec40c785f386, 51c32ae7fae14552d79f7139614b77c1bbd57a48, 63da961381e0d979459dede713001f8452364477, 7ac58d88
  • Monitor for kernel package updates from your Linux distribution vendor
  • If running custom kernels with MSCC Ocelot driver enabled, prioritize patching for systems handling high-throughput network traffic

Evidence notes

The CVE description explicitly identifies the missing lock protection in `ocelot_port_xmit_inj()` and references the fix adding `ocelot_lock_inj_grp()`/`ocelot_unlock_inj_grp()` around the register injection path. Six kernel.org stable tree commits are provided as references, indicating backports to multiple kernel versions.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45849 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45849

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45849 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45849

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/026f6513c5880c2c89e38ad66bbec2868f978605

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/0b217a40156f497e09dd20d3f7baec40c785f386

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/51c32ae7fae14552d79f7139614b77c1bbd57a48

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/63da961381e0d979459dede713001f8452364477

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/7ac58d8832802ec89baa7539e13e6d58a88cce04

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/cc1b179f778f98270bdbbb48d183b4b6427ae198

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.