CVE-2025-40347 (GCVE-0-2025-40347)
Vulnerability from cvelistv5 – Published: 2025-12-16 13:30 – Updated: 2026-08-05 12:09
VLAI
EPSS
VEX
Title
net: enetc: fix the deadlock of enetc_mdio_lock
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: enetc: fix the deadlock of enetc_mdio_lock
After applying the workaround for err050089, the LS1028A platform
experiences RCU stalls on RT kernel. This issue is caused by the
recursive acquisition of the read lock enetc_mdio_lock. Here list some
of the call stacks identified under the enetc_poll path that may lead to
a deadlock:
enetc_poll
-> enetc_lock_mdio
-> enetc_clean_rx_ring OR napi_complete_done
-> napi_gro_receive
-> enetc_start_xmit
-> enetc_lock_mdio
-> enetc_map_tx_buffs
-> enetc_unlock_mdio
-> enetc_unlock_mdio
After enetc_poll acquires the read lock, a higher-priority writer attempts
to acquire the lock, causing preemption. The writer detects that a
read lock is already held and is scheduled out. However, readers under
enetc_poll cannot acquire the read lock again because a writer is already
waiting, leading to a thread hang.
Currently, the deadlock is avoided by adjusting enetc_lock_mdio to prevent
recursive lock acquisition.
Severity
7.5 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
6d36ecdbc4410e61a0e02adc5d3abeee22a8ffd3 , < a649161526736f48bcc592e3a412e5bcd7dd9e24
(git)
Affected: 6d36ecdbc4410e61a0e02adc5d3abeee22a8ffd3 , < 2781ca82ce8cad263d80b617addb727e6a84c9e5 (git) Affected: 6d36ecdbc4410e61a0e02adc5d3abeee22a8ffd3 , < 1f92f5bd057a4fad9dab6af17963cdd21e5da6ed (git) Affected: 6d36ecdbc4410e61a0e02adc5d3abeee22a8ffd3 , < 2e55a49dc3b2a6b23329e4fbbd8a5feb20e220aa (git) Affected: 6d36ecdbc4410e61a0e02adc5d3abeee22a8ffd3 , < 50bd33f6b3922a6b760aa30d409cae891cec8fb5 (git) Affected: bf9c564716a13dde6a990d3b02c27cd6e39608bf (git) Affected: ff966263f5f9fdf9740f03fed0762ce73c230a6a (git) Affected: 5.10.24 , < 5.11 (semver) Affected: 5.11.7 , < 5.12 (semver) |
guessed | |
| Linux | Linux |
Affected:
5.12
Unaffected: 0 , < 5.12 (semver) Unaffected: 6.1.175 , ≤ 6.1.* (semver) Unaffected: 6.6.115 , ≤ 6.6.* (semver) Unaffected: 6.12.56 , ≤ 6.12.* (semver) Unaffected: 6.17.6 , ≤ 6.17.* (semver) Unaffected: 6.18 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/freescale/enetc/enetc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a649161526736f48bcc592e3a412e5bcd7dd9e24",
"status": "affected",
"version": "6d36ecdbc4410e61a0e02adc5d3abeee22a8ffd3",
"versionType": "git"
},
{
"lessThan": "2781ca82ce8cad263d80b617addb727e6a84c9e5",
"status": "affected",
"version": "6d36ecdbc4410e61a0e02adc5d3abeee22a8ffd3",
"versionType": "git"
},
{
"lessThan": "1f92f5bd057a4fad9dab6af17963cdd21e5da6ed",
"status": "affected",
"version": "6d36ecdbc4410e61a0e02adc5d3abeee22a8ffd3",
"versionType": "git"
},
{
"lessThan": "2e55a49dc3b2a6b23329e4fbbd8a5feb20e220aa",
"status": "affected",
"version": "6d36ecdbc4410e61a0e02adc5d3abeee22a8ffd3",
"versionType": "git"
},
{
"lessThan": "50bd33f6b3922a6b760aa30d409cae891cec8fb5",
"status": "affected",
"version": "6d36ecdbc4410e61a0e02adc5d3abeee22a8ffd3",
"versionType": "git"
},
{
"status": "affected",
"version": "bf9c564716a13dde6a990d3b02c27cd6e39608bf",
"versionType": "git"
},
{
"status": "affected",
"version": "ff966263f5f9fdf9740f03fed0762ce73c230a6a",
"versionType": "git"
},
{
"lessThan": "5.11",
"status": "affected",
"version": "5.10.24",
"versionType": "semver"
},
{
"lessThan": "5.12",
"status": "affected",
"version": "5.11.7",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/freescale/enetc/enetc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.12"
},
{
"lessThan": "5.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.56",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.17.*",
"status": "unaffected",
"version": "6.17.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.18",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.115",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.56",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17.6",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.10.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.11.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: enetc: fix the deadlock of enetc_mdio_lock\n\nAfter applying the workaround for err050089, the LS1028A platform\nexperiences RCU stalls on RT kernel. This issue is caused by the\nrecursive acquisition of the read lock enetc_mdio_lock. Here list some\nof the call stacks identified under the enetc_poll path that may lead to\na deadlock:\n\nenetc_poll\n -\u003e enetc_lock_mdio\n -\u003e enetc_clean_rx_ring OR napi_complete_done\n -\u003e napi_gro_receive\n -\u003e enetc_start_xmit\n -\u003e enetc_lock_mdio\n -\u003e enetc_map_tx_buffs\n -\u003e enetc_unlock_mdio\n -\u003e enetc_unlock_mdio\n\nAfter enetc_poll acquires the read lock, a higher-priority writer attempts\nto acquire the lock, causing preemption. The writer detects that a\nread lock is already held and is scheduled out. However, readers under\nenetc_poll cannot acquire the read lock again because a writer is already\nwaiting, leading to a thread hang.\n\nCurrently, the deadlock is avoided by adjusting enetc_lock_mdio to prevent\nrecursive lock acquisition."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The deadlock is driven from the enetc RX datapath (`enetc_poll` \u2192 `napi_gro_receive` \u2192 stack \u2192 `enetc_start_xmit`), reached purely by packets arriving on the Ethernet interface, including routed IP traffic from arbitrary remote networks. No L2 adjacency or local access is needed \u2014 a plain ICMP/TCP flow that elicits a reply or is forwarded suffices.\nAC:L - The attacker directly creates the recursive read-lock condition by sustaining inbound traffic that triggers a transmit from within the RX softirq, and the competing MDIO writer occurs many times per second from the periodic phylib/phylink state machine, so the collision is reached reliably within seconds and can be retried indefinitely.\nPR:N - The vulnerable path is the unauthenticated packet-receive path of the NIC driver; no credentials, capabilities, or local account are required \u2014 merely sending traffic to (or through) the affected interface is enough.\nUI:N - No victim action is needed; the deadlock arises from normal kernel-side packet processing and background PHY polling that run without any user involvement.\nS:U - The lock inversion hangs kernel threads within the same security authority as the affected kernel; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - This is a pure lock-ordering/recursion defect with no memory corruption, out-of-bounds access, or exposure of kernel data to the attacker.\nI:N - No data is modified and no write primitive is produced; the failure mode is threads blocking on an rt_mutex-backed rwlock, not memory corruption.\nA:H - The recursive read-lock acquisition deadlocks the NAPI poll thread against a waiting MDIO writer, producing RCU stalls, hung tasks, and permanent loss of network processing on the interface \u2014 a remotely inducible, unrecoverable denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:09:48.141Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a649161526736f48bcc592e3a412e5bcd7dd9e24"
},
{
"url": "https://git.kernel.org/stable/c/2781ca82ce8cad263d80b617addb727e6a84c9e5"
},
{
"url": "https://git.kernel.org/stable/c/1f92f5bd057a4fad9dab6af17963cdd21e5da6ed"
},
{
"url": "https://git.kernel.org/stable/c/2e55a49dc3b2a6b23329e4fbbd8a5feb20e220aa"
},
{
"url": "https://git.kernel.org/stable/c/50bd33f6b3922a6b760aa30d409cae891cec8fb5"
}
],
"title": "net: enetc: fix the deadlock of enetc_mdio_lock",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-40347",
"datePublished": "2025-12-16T13:30:21.539Z",
"dateReserved": "2025-04-16T07:20:57.187Z",
"dateUpdated": "2026-08-05T12:09:48.141Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2025-40347",
"date": "2026-11-02",
"epss": "0.00528",
"percentile": "0.44688"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/freescale/enetc/enetc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a649161526736f48bcc592e3a412e5bcd7dd9e24",
"status": "affected",
"version": "6d36ecdbc4410e61a0e02adc5d3abeee22a8ffd3",
"versionType": "git"
},
{
"lessThan": "2781ca82ce8cad263d80b617addb727e6a84c9e5",
"status": "affected",
"version": "6d36ecdbc4410e61a0e02adc5d3abeee22a8ffd3",
"versionType": "git"
},
{
"lessThan": "1f92f5bd057a4fad9dab6af17963cdd21e5da6ed",
"status": "affected",
"version": "6d36ecdbc4410e61a0e02adc5d3abeee22a8ffd3",
"versionType": "git"
},
{
"lessThan": "2e55a49dc3b2a6b23329e4fbbd8a5feb20e220aa",
"status": "affected",
"version": "6d36ecdbc4410e61a0e02adc5d3abeee22a8ffd3",
"versionType": "git"
},
{
"lessThan": "50bd33f6b3922a6b760aa30d409cae891cec8fb5",
"status": "affected",
"version": "6d36ecdbc4410e61a0e02adc5d3abeee22a8ffd3",
"versionType": "git"
},
{
"status": "affected",
"version": "bf9c564716a13dde6a990d3b02c27cd6e39608bf",
"versionType": "git"
},
{
"status": "affected",
"version": "ff966263f5f9fdf9740f03fed0762ce73c230a6a",
"versionType": "git"
},
{
"lessThan": "5.11",
"status": "affected",
"version": "5.10.24",
"versionType": "semver"
},
{
"lessThan": "5.12",
"status": "affected",
"version": "5.11.7",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/freescale/enetc/enetc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.12"
},
{
"lessThan": "5.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.56",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.17.*",
"status": "unaffected",
"version": "6.17.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.18",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: enetc: fix the deadlock of enetc_mdio_lock\n\nAfter applying the workaround for err050089, the LS1028A platform\nexperiences RCU stalls on RT kernel. This issue is caused by the\nrecursive acquisition of the read lock enetc_mdio_lock. Here list some\nof the call stacks identified under the enetc_poll path that may lead to\na deadlock:\n\nenetc_poll\n -\u003e enetc_lock_mdio\n -\u003e enetc_clean_rx_ring OR napi_complete_done\n -\u003e napi_gro_receive\n -\u003e enetc_start_xmit\n -\u003e enetc_lock_mdio\n -\u003e enetc_map_tx_buffs\n -\u003e enetc_unlock_mdio\n -\u003e enetc_unlock_mdio\n\nAfter enetc_poll acquires the read lock, a higher-priority writer attempts\nto acquire the lock, causing preemption. The writer detects that a\nread lock is already held and is scheduled out. However, readers under\nenetc_poll cannot acquire the read lock again because a writer is already\nwaiting, leading to a thread hang.\n\nCurrently, the deadlock is avoided by adjusting enetc_lock_mdio to prevent\nrecursive lock acquisition."
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet: enetc: corregir el interbloqueo de enetc_mdio_lock\n\nDespu\u00e9s de aplicar la soluci\u00f3n alternativa para err050089, la plataforma LS1028A experimenta bloqueos RCU en el kernel RT. Este problema es causado por la adquisici\u00f3n recursiva del bloqueo de lectura enetc_mdio_lock. Aqu\u00ed se enumeran algunas de las pilas de llamadas identificadas bajo la ruta enetc_poll que pueden conducir a un interbloqueo:\n\nenetc_poll\n -\u003e enetc_lock_mdio\n -\u003e enetc_clean_rx_ring OR napi_complete_done\n -\u003e napi_gro_receive\n -\u003e enetc_start_xmit\n -\u003e enetc_lock_mdio\n -\u003e enetc_map_tx_buffs\n -\u003e enetc_unlock_mdio\n -\u003e enetc_unlock_mdio\n\nDespu\u00e9s de que enetc_poll adquiere el bloqueo de lectura, un escritor de mayor prioridad intenta adquirir el bloqueo, causando la expropiaci\u00f3n. El escritor detecta que un bloqueo de lectura ya est\u00e1 retenido y es desprogramado. Sin embargo, los lectores bajo enetc_poll no pueden adquirir el bloqueo de lectura de nuevo porque un escritor ya est\u00e1 esperando, lo que lleva a un cuelgue del hilo.\n\nActualmente, el interbloqueo se evita ajustando enetc_lock_mdio para prevenir la adquisici\u00f3n recursiva del bloqueo."
}
],
"id": "CVE-2025-40347",
"lastModified": "2026-10-14T13:10:00.187",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary"
}
]
},
"published": "2025-12-16T14:15:46.470",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/1f92f5bd057a4fad9dab6af17963cdd21e5da6ed"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/2781ca82ce8cad263d80b617addb727e6a84c9e5"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/2e55a49dc3b2a6b23329e4fbbd8a5feb20e220aa"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/50bd33f6b3922a6b760aa30d409cae891cec8fb5"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/a649161526736f48bcc592e3a412e5bcd7dd9e24"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Deferred"
}
},
"redhat_vex": {
"aggregate_severity": "Important",
"current_release_date": "2026-07-30T08:17:08+00:00",
"cve": "CVE-2025-40347",
"id": "CVE-2025-40347",
"initial_release_date": "2025-12-16T00:00:00+00:00",
"product_status:known_affected": "76",
"product_status:known_not_affected": "198",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: net: enetc: fix the deadlock of enetc_mdio_lock",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40347.json",
"version": "3"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.