CVE-2026-23368: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23368 is an AB-BA deadlock vulnerability in the Linux kernel's PHY subsystem, specifically in the net/phy LED trigger registration path. It affects Linux kernel versions 4.16 through 7.0-rc7 across multiple stable branches, including 4.16.1–5.10.252, 5.11–5.15.202, 5.16–6.1.166, 6.2–6.6.129, 6.7–6.12.77, 6.13–6.18.16, and 6.19–6.19.6, as well as Microsoft's azl3_kernel_6.6.126.1-1. The vulnerability was disclosed on March 25, 2026, and has a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is improper lock ordering (CWE-667: Improper Locking / CWE-833: Deadlock) between triggers_list_lock and rtnl_mutex in the Linux kernel when both LEDS_TRIGGER_NETDEV and LED_TRIGGER_PHY kernel configuration options are enabled. The LED_TRIGGER_PHY path registers LED triggers during phy_attach_direct() while already holding the RTNL lock (rtnl_mutex), then attempts to acquire triggers_list_lock. Concurrently, LEDS_TRIGGER_NETDEV acquires triggers_list_lock first (via led_trigger_write() through sysfs) and then attempts to acquire rtnl_mutex via register_netdevice_notifier(), creating a classical AB-BA deadlock. The fix moves phy_led_triggers_register() to the PHY probe/release path, which does not hold RTNL, eliminating the lock ordering conflict (Red Hat Bugzilla).

Successful exploitation causes a system deadlock, resulting in a denial-of-service condition with high availability impact and no confidentiality or integrity impact. The deadlock prevents normal network operations and system responsiveness, potentially requiring a reboot to recover. The affected scope is limited to the local system; there is no known path for lateral movement or data exfiltration (Red Hat Advisory, Red Hat Bugzilla).

Update to a patched Linux kernel version: 5.10.253 or later, 5.15.203 or later, 6.1.167 or later, 6.6.130 or later, 6.12.78 or later, 6.18.17 or later, or 6.19.7 or later. Multiple upstream fixes have been committed to the stable kernel tree (commits 241cd64c, 2764dcb3, 2b01518e, 305afdd0, c33523b8, c6ffc2d2, c8dbdc6e, cde2d0b5). As a temporary workaround, disable either the LEDS_TRIGGER_NETDEV or LED_TRIGGER_PHY kernel configuration option in your kernel build to prevent the deadlock condition from occurring (Red Hat Bugzilla, Red Hat Advisory).

The vulnerability was tracked by Red Hat's Product Security team and filed via OSIDB automated import. Debian issued security advisories (DSA-6243-1 and DLA-4561-1) addressing this CVE in their linux packages, and SUSE released security updates (SUSE-SU-202621834-1 and SUSE-SU-20262217-1). Amazon Linux 2023 also issued advisories (ALAS2023-2026-1594 and ALAS2023-2026-1681). No notable independent researcher commentary or significant social media discussion has been identified for this vulnerability.