CVE-2026-23165: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23165 is a deadlock vulnerability in the Linux kernel's sfc (Solarflare) network driver related to improper locking during RSS (Receive Side Scaling) configuration reads. The flaw arises because the driver's ethtool RSS handler re-acquires net_device's rss_lock after the kernel core already holds it when processing ethtool -x commands, resulting in a deadlock. It affects Linux kernel versions from 6.17 up to (but not including) 6.18.9, as well as 6.19 release candidates (rc1 through rc7). It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is classified as CWE-667 (Improper Locking). A cited upstream commit introduced locking of net_device's rss_lock at the kernel core level when handling ethtool -x (get RSS configuration) commands; however, the sfc driver's own implementation also attempted to acquire the same lock, causing a double-lock deadlock. The fix removes the redundant lock acquisition from the driver's RSS read path. Exploitation requires local access and low privileges — a local user can trigger the deadlock by invoking ethtool -x on an sfc-managed interface, causing the kernel to hang (Feedly, Kernel Patch 1, Kernel Patch 2).

Successful exploitation causes a kernel deadlock, resulting in a denial of service (system hang or unresponsiveness) on the affected host. There is no confidentiality or integrity impact — only availability is affected, as the deadlock can render the system inoperable until rebooted. The impact is limited to systems running the sfc (Solarflare) network driver on affected kernel versions (Feedly).

1. Identify target: Confirm the target system is running a Linux kernel version between 6.17 and 6.18.8 (inclusive) or a 6.19-rc kernel, with a Solarflare (sfc) network interface present.
2. Obtain local access: Gain a local shell session on the target system with at least low-privilege user access.
3. Identify the sfc interface: Run ip link show or ls /sys/class/net/ to identify the network interface managed by the sfc driver (e.g., eth0).
4. Trigger the deadlock: Execute ethtool -x <interface> (e.g., ethtool -x eth0). This causes the kernel core to acquire rss_lock, after which the sfc driver attempts to re-acquire the same lock, resulting in a deadlock.
5. Denial of service achieved: The kernel thread hangs indefinitely, potentially causing the system to become unresponsive and requiring a hard reboot to recover (Feedly).

• Logs: Kernel logs (dmesg or /var/log/kern.log) showing lockdep warnings such as WARNING: possible circular locking dependency detected or INFO: task <ethtool>:<pid> blocked for more than 120 seconds related to rss_lock or the sfc driver.
• Process: ethtool process stuck in uninterruptible sleep (D state) visible via ps aux or top, associated with an sfc-managed interface.
• System: System becoming unresponsive or network interfaces on Solarflare cards ceasing to function following execution of ethtool -x on an sfc interface.

The Linux kernel project has released patches addressing this vulnerability. Users should upgrade to Linux kernel version 6.18.9 or later, or apply the stable-tree patches available at the official kernel git repository. For systems that cannot be immediately patched, restricting local user access to ethtool commands (e.g., via capability restrictions or removing CAP_NET_ADMIN from unprivileged users) can reduce exposure. Distributions shipping affected kernel versions should apply vendor-provided updates as they become available (Kernel Patch 1, Kernel Patch 2).