Unrated severityNVD Advisory· Published Jun 8, 2026

CVE-2026-46287

Description

Linux kernel txgbe driver has an RTNL assertion warning during module removal for copper NICs with external PHYs.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Linux kernel txgbe driver has an RTNL assertion warning during module removal for copper NICs with external PHYs.

Vulnerability

The Linux kernel's txgbe driver, specifically for copper NICs with external PHYs, experiences an RTNL assertion warning when the module is removed. This occurs because phylink_disconnect_phy() is called during the module's remove function without proper locking, leading to an assertion failure in drivers/net/phy/phylink.c [1]. The affected versions are not explicitly stated but the fix is present in the provided reference.

Exploitation

An attacker would need to trigger the removal of the txgbe kernel module. This typically requires elevated privileges on the system, such as root access, to execute the rmmod command. The vulnerability is triggered during the module's unload sequence when interacting with external PHY hardware.

Impact

The primary impact of this vulnerability is an RTNL assertion warning, which indicates a potential race condition or improper locking within the kernel's network subsystem. While not leading to code execution or data corruption, it can cause system instability, kernel panics, or denial of service due to the assertion failure during module removal.

Mitigation

The vulnerability is resolved by adding rtnl_lock() and rtnl_unlock() around the phylink_disconnect_phy() call within the txgbe driver's remove function. This ensures proper synchronization and prevents the assertion warning. The fix is available in the Linux kernel source code [1]. No workaround is described, and the vulnerability is not listed as part of the KEV catalog.

References

Making sure you're not a bot!

AI Insight generated on Jun 8, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

Linux/Kernelllm-fuzzy
Linux/txgbellm-fuzzy

Patches

d29cafc7e4ee

net: txgbe: fix RTNL assertion warning when remove module

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitJiawen WuFixed in 6.18.27via kernel-cna

commit

1 file changed · +2 −1

drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c+2 −1 modified

diff --git a/drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c b/drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c
index 03f1b9bc604d5..9b6f5cd3fdd7d 100644
--- a/drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c
+++ b/drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c
@@ -659,7 +659,9 @@ void txgbe_remove_phy(struct txgbe *txgbe)
 		return;
 	case wx_mac_sp:
 		if (txgbe->wx->media_type == wx_media_copper) {
+			rtnl_lock();
 			phylink_disconnect_phy(txgbe->wx->phylink);
+			rtnl_unlock();
 			phylink_destroy(txgbe->wx->phylink);
 			return;
 		}
-- 
cgit 1.3-korg

6c5ec52c68a6

net: txgbe: fix RTNL assertion warning when remove module

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitJiawen WuFixed in 7.0.4via kernel-cna

commit

1 file changed · +2 −1

drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c+2 −1 modified

diff --git a/drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c b/drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c
index 8ea7aa07ae4e9..dc9f243146580 100644
--- a/drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c
+++ b/drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c
@@ -657,7 +657,9 @@ void txgbe_remove_phy(struct txgbe *txgbe)
 		return;
 	case wx_mac_sp:
 		if (txgbe->wx->media_type == wx_media_copper) {
+			rtnl_lock();
 			phylink_disconnect_phy(txgbe->wx->phylink);
+			rtnl_unlock();
 			phylink_destroy(txgbe->wx->phylink);
 			return;
 		}
-- 
cgit 1.3-korg

e159f05e12cc

net: txgbe: fix RTNL assertion warning when remove module

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitJiawen WuFixed in 7.1-rc1via kernel-cna

commit

1 file changed · +2 −1

drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c+2 −1 modified

diff --git a/drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c b/drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c
index 8ea7aa07ae4e9..dc9f243146580 100644
--- a/drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c
+++ b/drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c
@@ -657,7 +657,9 @@ void txgbe_remove_phy(struct txgbe *txgbe)
 		return;
 	case wx_mac_sp:
 		if (txgbe->wx->media_type == wx_media_copper) {
+			rtnl_lock();
 			phylink_disconnect_phy(txgbe->wx->phylink);
+			rtnl_unlock();
 			phylink_destroy(txgbe->wx->phylink);
 			return;
 		}
-- 
cgit 1.3-korg

3e223a7fd41c

net: txgbe: fix RTNL assertion warning when remove module

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitJiawen WuFixed in 6.12.88via kernel-cna

commit

1 file changed · +2 −1

drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c+2 −1 modified

diff --git a/drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c b/drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c
index f26946198a2fb..9726622a96bfb 100644
--- a/drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c
+++ b/drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c
@@ -622,7 +622,9 @@ err_unregister_swnode:
 void txgbe_remove_phy(struct txgbe *txgbe)
 {
 	if (txgbe->wx->media_type == sp_media_copper) {
+		rtnl_lock();
 		phylink_disconnect_phy(txgbe->wx->phylink);
+		rtnl_unlock();
 		phylink_destroy(txgbe->wx->phylink);
 		return;
 	}
-- 
cgit 1.3-korg

0305e7118451

net: txgbe: fix RTNL assertion warning when remove module

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitJiawen WuFixed in 6.6.140via kernel-cna

commit

1 file changed · +2 −1

drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c+2 −1 modified

diff --git a/drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c b/drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c
index 4159c84035fdc..2494a3a171fdc 100644
--- a/drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c
+++ b/drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c
@@ -820,7 +820,9 @@ err_unregister_swnode:
 void txgbe_remove_phy(struct txgbe *txgbe)
 {
 	if (txgbe->wx->media_type == sp_media_copper) {
+		rtnl_lock();
 		phylink_disconnect_phy(txgbe->phylink);
+		rtnl_unlock();
 		phylink_destroy(txgbe->phylink);
 		return;
 	}
-- 
cgit 1.3-korg

3e223a7fd41c

net: txgbe: fix RTNL assertion warning when remove module

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.gitJiawen Wuvia nvd-ref

commit

1 file changed · +2 −1

drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c+2 −1 modified

diff --git a/drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c b/drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c
index f26946198a2fb..9726622a96bfb 100644
--- a/drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c
+++ b/drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c
@@ -622,7 +622,9 @@ err_unregister_swnode:
 void txgbe_remove_phy(struct txgbe *txgbe)
 {
 	if (txgbe->wx->media_type == sp_media_copper) {
+		rtnl_lock();
 		phylink_disconnect_phy(txgbe->wx->phylink);
+		rtnl_unlock();
 		phylink_destroy(txgbe->wx->phylink);
 		return;
 	}
-- 
cgit 1.3-korg

6c5ec52c68a6

net: txgbe: fix RTNL assertion warning when remove module

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.gitJiawen Wuvia nvd-ref

commit

1 file changed · +2 −1

drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c+2 −1 modified

diff --git a/drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c b/drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c
index 8ea7aa07ae4e9..dc9f243146580 100644
--- a/drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c
+++ b/drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c
@@ -657,7 +657,9 @@ void txgbe_remove_phy(struct txgbe *txgbe)
 		return;
 	case wx_mac_sp:
 		if (txgbe->wx->media_type == wx_media_copper) {
+			rtnl_lock();
 			phylink_disconnect_phy(txgbe->wx->phylink);
+			rtnl_unlock();
 			phylink_destroy(txgbe->wx->phylink);
 			return;
 		}
-- 
cgit 1.3-korg

d29cafc7e4ee

net: txgbe: fix RTNL assertion warning when remove module

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.gitJiawen Wuvia nvd-ref

commit

1 file changed · +2 −1

drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c+2 −1 modified

diff --git a/drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c b/drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c
index 03f1b9bc604d5..9b6f5cd3fdd7d 100644
--- a/drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c
+++ b/drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c
@@ -659,7 +659,9 @@ void txgbe_remove_phy(struct txgbe *txgbe)
 		return;
 	case wx_mac_sp:
 		if (txgbe->wx->media_type == wx_media_copper) {
+			rtnl_lock();
 			phylink_disconnect_phy(txgbe->wx->phylink);
+			rtnl_unlock();
 			phylink_destroy(txgbe->wx->phylink);
 			return;
 		}
-- 
cgit 1.3-korg

0305e7118451

net: txgbe: fix RTNL assertion warning when remove module

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.gitJiawen Wuvia nvd-ref

commit

1 file changed · +2 −1

drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c+2 −1 modified

diff --git a/drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c b/drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c
index 4159c84035fdc..2494a3a171fdc 100644
--- a/drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c
+++ b/drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c
@@ -820,7 +820,9 @@ err_unregister_swnode:
 void txgbe_remove_phy(struct txgbe *txgbe)
 {
 	if (txgbe->wx->media_type == sp_media_copper) {
+		rtnl_lock();
 		phylink_disconnect_phy(txgbe->phylink);
+		rtnl_unlock();
 		phylink_destroy(txgbe->phylink);
 		return;
 	}
-- 
cgit 1.3-korg

e159f05e12cc

net: txgbe: fix RTNL assertion warning when remove module

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.gitJiawen Wuvia nvd-ref

commit

1 file changed · +2 −1

drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c+2 −1 modified

diff --git a/drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c b/drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c
index 8ea7aa07ae4e9..dc9f243146580 100644
--- a/drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c
+++ b/drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c
@@ -657,7 +657,9 @@ void txgbe_remove_phy(struct txgbe *txgbe)
 		return;
 	case wx_mac_sp:
 		if (txgbe->wx->media_type == wx_media_copper) {
+			rtnl_lock();
 			phylink_disconnect_phy(txgbe->wx->phylink);
+			rtnl_unlock();
 			phylink_destroy(txgbe->wx->phylink);
 			return;
 		}
-- 
cgit 1.3-korg

Vulnerability mechanics

Root cause

"The txgbe driver's remove function calls phylink_disconnect_phy without holding the RTNL lock, leading to an assertion failure."

Attack vector

This vulnerability is triggered when the txgbe module is removed. The driver's `txgbe_remove_phy` function, specifically when handling `wx_mac_sp` and `wx_media_copper`, calls `phylink_disconnect_phy` without proper locking. This occurs during the unbinding or unloading of the txgbe driver from the system.

Affected code

The vulnerability exists in the `txgbe_remove_phy` function within the file `drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c`. Specifically, the code path for copper media types calls `phylink_disconnect_phy` without acquiring the necessary RTNL lock.

What the fix does

The patch addresses the RTNL assertion warning by adding `rtnl_lock()` and `rtnl_unlock()` calls around the `phylink_disconnect_phy()` function within the `txgbe_remove_phy` function in `drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c` [patch_id=5239507]. This ensures that the network routing information (RTNL) is properly locked during the disconnection of the PHY, preventing the assertion failure that occurred when the module was removed.

Generated on Jun 8, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000