PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-74523 Linux CVE debrief

A Linux kernel vulnerability in the qede driver can cause a deadlock in the recovery path, leading to a denial-of-service condition. The vulnerability occurs when a TX timeout on a qede NIC with VXLAN/GENEVE tunnel ports configured wedges the rtnetlink control plane of the whole machine. This issue arises from a mutex deadlock in the qede_recovery_handler, which blocks the kworker and prevents the recovery process from completing. Linux kernel developers and administrators should assess their exposure and take necessary actions to mitigate the vulnerability. The vulnerability has a CVSS score of 7.5 and is considered HIGH severity.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-15
Original CVE updated
2026-10-16
Advisory published
2026-08-15
Advisory updated
2026-10-16

Who should care

Linux kernel developers and administrators responsible for maintaining and securing Linux-based systems, particularly those using qede NICs with VXLAN/GENEVE tunnel ports configured, should assess their exposure and take necessary actions to mitigate the vulnerability.

Why it matters

The CVE-2026-74523 vulnerability in the Linux kernel's qede driver can cause a deadlock in the recovery path, leading to a denial-of-service condition. Linux kernel developers and administrators should assess their exposure and take necessary actions to mitigate the vulnerability.

  • Denial-of-service condition affecting the rtnetlink control plane
  • Potential impact on network connectivity and system stability
  • Need for patching and remediation to prevent exploitation

Technical summary

The vulnerability occurs in the qede driver's recovery path, where a TX timeout on a qede NIC with VXLAN/GENEVE tunnel ports configured causes a deadlock on the driver's own mutex. This deadlock leads to a denial-of-service condition, affecting the rtnetlink control plane of the whole machine. The mutex is not recursive, causing the kworker to block on itself with rtnl_lock held, and neither lock is ever released. The vulnerability has a significant impact on system stability and network connectivity, and Linux kernel developers and administrators should take necessary actions to mitigate the vulnerability.

Defensive priority

High

Recommended defensive actions

  • Review and apply the provided patches to fix the vulnerability
  • Monitor the system for TX timeouts on qede NICs with VXLAN/GENEVE tunnel ports configured
  • Consider implementing compensating controls to mitigate the impact of a potential denial-of-service condition
  • Perform a thorough review of the system configuration and network setup
  • Verify that the system is running with the latest software updates and patches
  • Implement additional monitoring and logging to detect potential security incidents
  • Conduct a risk assessment to identify potential vulnerabilities and prioritize remediation efforts

Evidence notes

The vulnerability is caused by a deadlock in the qede driver's recovery path. The recovery path deadlocks on the driver's own mutex, which is not recursive, causing the kworker to block on itself with rtnl_lock held, and neither lock is ever released.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-74523 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-74523

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-74523 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-74523

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • qede: sync udp_tunnel ports outside qede_lock in the recovery path

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/74xxx/CVE-2026-74523.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/19e505ee8bb9e0f0355eda9e9f614fb25fed0070

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/c4c1e5d6bc2b900b2328d6fff93dc8146b858d69

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/8e1bdf57de91247e57816482966265ada573cc74

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/e382a4efeeae6555b95d9ff336cf3094ee7d336b

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/4626df3f63c9185efba5750fe76ac01ab3351bae

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/e51becb8f3377a377171ed5bf0082b96e22e6292

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/6f1ef8170d3d8ad9319aa01347945dcdf5cc4f27

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.