CVE-2026-45849

Description

In the Linux kernel, the following vulnerability has been resolved: net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() ocelot_port_xmit_inj() calls ocelot_can_inject() and ocelot_port_inject_frame() without holding the injection group lock. Both functions contain lockdep_assert_held() for the injection lock, and the correct caller felix_port_deferred_xmit() properly acquires the lock using ocelot_lock_inj_grp() before calling these functions. Add ocelot_lock_inj_grp()/ocelot_unlock_inj_grp() around the register injection path to fix the missing lock protection. The FDMA path is not affected as it uses its own locking mechanism.

Is your site exposed to CVE-2026-45849?

Run a free security scan — no signup, results in seconds.

EPSS — Exploit Prediction

0.0022

Probability of exploitation

0.12%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/026f6513c5880c2c89e38ad66bbec2868f978605 https://git.kernel.org/stable/c/0b217a40156f497e09dd20d3f7baec40c785f386 https://git.kernel.org/stable/c/51c32ae7fae14552d79f7139614b77c1bbd57a48 https://git.kernel.org/stable/c/63da961381e0d979459dede713001f8452364477 https://git.kernel.org/stable/c/7ac58d8832802ec89baa7539e13e6d58a88cce04 https://git.kernel.org/stable/c/cc1b179f778f98270bdbbb48d183b4b6427ae198

Frequently Asked Questions

What is CVE-2026-45849? +

In the Linux kernel, the following vulnerability has been resolved: net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() ocelot_port_xmit_inj() calls ocelot_can_inject() and ocelot_port_inject_frame() without holding the injection group lock. Both functions contain lockdep_assert_held() for the injection lock, and the correct caller felix_port_deferred_xmit() properly acquires the lock using ocelot_lock_inj_grp() before calling these functions. Add ocelot_lock_inj_grp()/ocelot_unlock_inj_grp() around the register injection path to fix the missing lock protection. The FDMA path is not affected as it uses its own locking mechanism.

How do I check if I'm vulnerable to CVE-2026-45849? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.