A vulnerability in the Linux kernel's ocelot network driver involved missing lock protection in the function ocelot_port_xmit_inj(). (CVE-2026-45849)
A vulnerability in the Linux kernel's ocelot network driver involved missing lock protection in the function ocelot_port_xmit_inj(). This function called other functions that require holding a specific injection group lock, but the lock was not acquired, potentially leading to concurrency issues. The issue was fixed by adding the appropriate lock acquisition and release around the affected code path. The FDMA path is unaffected as it uses a different locking mechanism.
AI Analysis
Technical Summary
The Linux kernel's ocelot driver had a concurrency vulnerability due to missing lock protection in the ocelot_port_xmit_inj() function. This function called ocelot_can_inject() and ocelot_port_inject_frame() without holding the required injection group lock, violating lock dependency assertions. The correct locking sequence involves acquiring the injection group lock via ocelot_lock_inj_grp() before these calls, as done in felix_port_deferred_xmit(). The fix adds the missing lock acquisition and release around the register injection path, preventing potential race conditions. The FDMA injection path is unaffected since it uses a separate locking mechanism.
Potential Impact
The vulnerability can cause a loss of availability (denial of service) due to concurrency issues in the network driver, as indicated by the CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). There is no impact on confidentiality or integrity. No known exploits are reported in the wild.
Mitigation Recommendations
A fix has been implemented in the Linux kernel by adding the missing lock protection around the affected code path. Since no explicit patch links or vendor advisories are provided, users should update to the latest Linux kernel versions where this fix is included. Patch status is not yet confirmed — check the official Linux kernel advisories or repositories for current remediation guidance.
A vulnerability in the Linux kernel's ocelot network driver involved missing lock protection in the function ocelot_port_xmit_inj(). (CVE-2026-45849)
Description
A vulnerability in the Linux kernel's ocelot network driver involved missing lock protection in the function ocelot_port_xmit_inj(). This function called other functions that require holding a specific injection group lock, but the lock was not acquired, potentially leading to concurrency issues. The issue was fixed by adding the appropriate lock acquisition and release around the affected code path. The FDMA path is unaffected as it uses a different locking mechanism.
CVSS v3.1
Score 5.5medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel's ocelot driver had a concurrency vulnerability due to missing lock protection in the ocelot_port_xmit_inj() function. This function called ocelot_can_inject() and ocelot_port_inject_frame() without holding the required injection group lock, violating lock dependency assertions. The correct locking sequence involves acquiring the injection group lock via ocelot_lock_inj_grp() before these calls, as done in felix_port_deferred_xmit(). The fix adds the missing lock acquisition and release around the register injection path, preventing potential race conditions. The FDMA injection path is unaffected since it uses a separate locking mechanism.
Potential Impact
The vulnerability can cause a loss of availability (denial of service) due to concurrency issues in the network driver, as indicated by the CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). There is no impact on confidentiality or integrity. No known exploits are reported in the wild.
Mitigation Recommendations
A fix has been implemented in the Linux kernel by adding the missing lock protection around the affected code path. Since no explicit patch links or vendor advisories are provided, users should update to the latest Linux kernel versions where this fix is included. Patch status is not yet confirmed — check the official Linux kernel advisories or repositories for current remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-v32h-7447-3j7r
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-45849"]
- Ecosystems
- []
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a3ef7f027e9c79719035c82
Added to database: 06/26/2026, 22:06:40 UTC
Last enriched: 06/26/2026, 22:51:10 UTC
Last updated: 07/31/2026, 19:24:49 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.