PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46031 Linux CVE debrief

A deadlock vulnerability exists in the Linux kernel's KS8851 Ethernet driver. The issue arises when the driver's IRQ handler executes concurrently with softirq processing under specific conditions. When CONFIG_PREEMPT_RT is enabled and packets are both transmitted and received, the netdev_alloc_skb_ip_align() function can trigger pending softirq processing via local_bh_enable(), which may invoke the driver's .xmit callback ks8851_start_xmit_par(). This callback attempts to acquire a spinlock already held by ks8851_irq(), causing a deadlock. The vulnerability also affects non-RT kernels since commit 0913ec336a6c0 due to softirq processing on return from spin_unlock_bh(). The fix reinstates disabling of bottom halves (BH) around critical sections including the IRQ handler, preventing net_tx_action() softirq from executing during these sections.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-16
Advisory published
2026-05-27
Advisory updated
2026-06-16

Who should care

Linux system administrators running kernels with KS8851 Ethernet hardware, particularly those using CONFIG_PREEMPT_RT real-time kernels. Embedded systems developers utilizing KS8851 chips for network connectivity. Kernel maintainers responsible for stable branch backports.

Technical summary

The KS8851 Ethernet driver in the Linux kernel contains a deadlock condition triggered by improper bottom-half (BH) handling during IRQ processing. The vulnerability manifests when: (1) ks8851_irq() executes and holds the ks->statelock spinlock; (2) TX packet transmission via netif_wake_queue() schedules TX softirq; (3) RX packet processing calls netdev_alloc_skb_ip_align() which invokes local_bh_enable(); (4) the enabled BH triggers net_tx_action() softirq, which calls ks8851_start_xmit_par(); (5) ks8851_start_xmit_par() attempts to acquire ks->statelock, already held by ks8851_irq(). This creates a recursive lock acquisition deadlock. The fix disables BH around critical sections in the IRQ handler using local_bh_disable()/local_bh_enable(), ensuring softirq processing occurs only after all IRQ handler actions complete and locks are released.

Defensive priority

high

Recommended defensive actions

  • Apply kernel patches from stable branches: 21f1707a8e978558dcb11b053855521e32ac0eec, 518040324067d8efaa2da1992297b7e7bf5640f4, 5c9fcac3c872224316714d0d8914d9af16c76a6d, 640a7631d31db87d5fa1b34cea44a99b6e78854b, be8aad558
  • Monitor kernel logs for deadlock traces involving ks8851_start_xmit_par and ks8851_irq
  • If running CONFIG_PREEMPT_RT kernels with KS8851 hardware, prioritize patching due to increased deadlock risk
  • Consider disabling KS8851 driver if hardware is not required and patching is not immediately feasible

Evidence notes

Vulnerability description and fix details sourced from official CVE record and NVD entry. Kernel commit references provided in source metadata confirm patch availability across stable branches.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46031 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46031

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46031 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46031

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/21f1707a8e978558dcb11b053855521e32ac0eec

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/518040324067d8efaa2da1992297b7e7bf5640f4

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/5c9fcac3c872224316714d0d8914d9af16c76a6d

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/640a7631d31db87d5fa1b34cea44a99b6e78854b

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/be8aad558b4675f45b43080f81a9ffdeddea73a5

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.