CVE-2026-23045

Root

Cause

The vulnerability is a missing lock assertion in the Linux kernel's Elastic Network Adapter (ENA) driver. When the driver calls devl_param_driverinit_value_set() during ena_devlink_alloc(), it does so without holding the required devlink lock, triggering a devl_assert_locked warning [1][2]. The warning appears in the kernel log as a WARN_ON and stack trace, indicating a locking violation in the devlink core.

Exploitation

Context

This issue occurs during the normal device probe path (ena_probe), specifically when the driver initializes devlink parameters. No special privileges or network access are required; the bug manifests on any system using the ENA driver (e.g., Amazon EC2 instances) when the kernel is built with lock debugging enabled. The attack surface is limited to triggering the warning, which may cause denial of service if the system is configured to panic on warnings.

Impact

An attacker with local access or the ability to trigger device re-probe could cause repeated kernel warnings, potentially leading to system instability or denial of service. The warning itself does not directly allow privilege escalation or data corruption, but itegrity compromise, but it indicates a race condition that could be leveraged in more complex attacks.

Mitigation

The fix is included in Linux kernel stable updates. Users should apply the latest kernel patches from their distribution. The commit references [1] and [2] contain the corrected code that acquires the devlink lock before calling devl_param_driverinit_value_set().