{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.18.14-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  net/mlx5e: Fix deadlocks between devlink and netdev instance locks  In the mentioned \"Fixes\" commit, various work tasks triggering devlink health reporter recovery were switched to use netdev_trylock to protect against concurrent tear down of the channels being recovered. But this had the side effect of introducing potential deadlocks because of incorrect lock ordering.  The correct lock order is described by the init flow: probe_one -\u003e mlx5_init_one (acquires devlink lock) -\u003e mlx5_init_one_devl_locked -\u003e mlx5_register_device -\u003e mlx5_rescan_drivers_locked -...-\u003e mlx5e_probe -\u003e _mlx5e_probe -\u003e register_netdev (acquires rtnl lock) -\u003e register_netdevice (acquires netdev lock) =\u003e devlink lock -\u003e rtnl lock -\u003e netdev lock.  But in the current recovery flow, the order is wrong: mlx5e_tx_err_cqe_work (acquires netdev lock) -\u003e mlx5e_reporter_tx_err_cqe -\u003e mlx5e_health_report -\u003e devlink_health_report (acquires devlink lock =\u003e boom!) -\u003e devlink_health_reporter_recover -\u003e mlx5e_tx_reporter_recover -\u003e mlx5e_tx_reporter_recover_from_ctx -\u003e mlx5e_tx_reporter_err_cqe_recover  The same pattern exists in: mlx5e_reporter_rx_timeout mlx5e_reporter_tx_ptpsq_unhealthy mlx5e_reporter_tx_timeout  Fix these by moving the netdev_trylock calls from the work handlers lower in the call stack, in the respective recovery functions, where they are actually necessary.",
  "id": "DEBIAN-CVE-2026-45907",
  "modified": "2026-09-14T16:47:38.631922332Z",
  "published": "2026-05-27T14:17:05.233Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-45907"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-45907"
  ]
}