CVE-2026-46031

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: ks8851: Reinstate disabling of BHs around IRQ handler

If the driver executes ks8851_irq() AND a TX packet has been sent, then

the driver enables TX queue via netif_wake_queue() which schedules TX

softirq to queue packets for this device.

If CONFIG_PREEMPT_RT=y is set AND a packet has also been received by

the MAC, then ks8851_rx_pkts() calls netdev_alloc_skb_ip_align() to

allocate SKBs for the received packets. If netdev_alloc_skb_ip_align()

is called with BH enabled, then local_bh_enable() at the end of

netdev_alloc_skb_ip_align() will trigger the pending softirq processing,

which may ultimately call the .xmit callback ks8851_start_xmit_par().

The ks8851_start_xmit_par() will try to lock struct ks8851_net_par

.lock spinlock, which is already locked by ks8851_irq() from which

ks8851_start_xmit_par() was called. This leads to a deadlock, which

is reported by the kernel, including a trace listed below.

If CONFIG

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References