CVE-2025-40347

Vulnerability

CVE-2025-40347 describes a deadlock in the Linux kernel's enetc network driver. The root cause is the recursive acquisition of the read lock enetc_mdio_lock within the enetc_poll function. After applying a workaround for errata err050089 on the LS1028A platform, the system experienced RCU stalls on RT (real-time) kernels due to this locking flaw [1][2].

Exploitation

Under the enetc_poll path, the driver holds a read lock on enetc_mdio_lock and then may attempt to acquire it again via call chains such as napi_gro_receive -> enetc_start_xmit -> enetc_lock_mdio. If a higher-priority writer is waiting for the lock, the reader cannot reacquire it, causing a thread hang and eventual deadlock. This condition occurs during normal packet processing and does not require any special attacker access [1][2].

Impact

An attacker able to trigger sufficient network traffic to invoke the enetc_poll path could cause a kernel deadlock, leading to a denial of service on the affected LS1028A-based systems. The vulnerability is specific to configurations that include the err050089 workaround combined with a real-time kernel [1][2].

Mitigation

The fix, already applied in the kernel stable tree, modifies enetc_lock_mdio to avoid recursive lock acquisition. Users should update to a kernel version containing commit 50bd33f6b3922a6b760aa30d409cae891cec8fb5 or later [1][2].