CVE-2026-43468

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: Fix deadlock between devlink lock and esw->wq

esw->work_queue executes esw_functions_changed_event_handler ->

esw_vfs_changed_event_handler and acquires the devlink lock.

.eswitch_mode_set (acquires devlink lock in devlink_nl_pre_doit) ->

mlx5_devlink_eswitch_mode_set -> mlx5_eswitch_disable_locked ->

mlx5_eswitch_event_handler_unregister -> flush_workqueue deadlocks

when esw_vfs_changed_event_handler executes.

Fix that by no longer flushing the work to avoid the deadlock, and using

a generation counter to keep track of work relevance. This avoids an old

handler manipulating an esw that has undergone one or more mode changes:

- the counter is incremented in mlx5_eswitch_event_handler_unregister.

- the counter is read and passed to the ephemeral mlx5_host_work struct.

- the work handler takes the devlink lock and bails out if the current

generation is different than the one it was scheduled to operate on

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References