CVE-2026-23045: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23045 is a missing lock vulnerability in the Linux kernel's net/ena (Elastic Network Adapter) driver that triggers an assert lock warning when devl_param_driverinit_value_set() is called without holding the required devlink lock. The issue manifests during device probing (ena_probe) on Amazon EC2 instances and was published on February 4, 2026. It affects Linux kernel versions between commit 816b52624cf6 and f2c4bcfa193e (stable branch) and between 816b52624cf6 and 8da901ffe497 (another stable branch), with fixes available in Linux 6.18.6 and 6.19-rc5. The CVSS category is estimated as Medium, with an EPSS score of 0.00024 (Feedly, EUVD).

The root cause is a missing synchronization primitive (CWE-667: Improper Locking) in the ena_devlink_alloc() function of the Linux kernel's ENA network driver. When devl_param_driverinit_value_set() is called during device initialization via ena_probe(), the devlink lock (devl_assert_locked) is not held, violating the locking contract enforced by the devlink subsystem. The kernel's lockdep mechanism detects this and emits a WARNING at net/devlink/core.c:261, with the call trace showing the violation originating from a workqueue context (kworker/0:0) on Amazon EC2 hardware. The fix involves acquiring the devlink lock before calling devl_param_driverinit_value_set() within ena_devlink_alloc() (Feedly, EUVD).

The vulnerability can cause kernel warning splats and potential undefined behavior due to unsynchronized access to devlink parameters during ENA driver initialization. In the worst case, the missing lock could lead to race conditions affecting the integrity of network device configuration, potentially causing system instability or denial of service on affected Amazon EC2 instances using the ENA driver. Confidentiality impact is considered negligible, as the flaw is primarily a locking correctness issue rather than an information disclosure or privilege escalation vector (Feedly).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2026-23045. The EPSS score is 0.00024 (approximately 0.024%), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and it is detected by Nessus plugin 297926 (Feedly, Tenable).

The Linux kernel maintainers have released patches addressing this issue in stable versions 6.18.6 and 6.19-rc5. The fix commits are f2c4bcfa193eef1b7457a56be9c47a8de015f225 and 8da901ffe497a53fa4ecc3ceed0e6d771586f88e in the stable kernel tree. Administrators running affected kernel versions on Amazon EC2 instances with ENA network adapters should update to Linux 6.18.6 or later. No configuration-based workaround is available; upgrading the kernel is the recommended remediation (EUVD, Feedly).