CVE-2023-54149

A suspicious RCU usage warning was found in the Linux kernel's DSA (Distributed Switch Architecture) networking subsystem. When synchronizing VLAN-aware MAC addresses, vlan_for_each() is called from ndo_set_rx_mode() without holding rtnl_lock(). This violates the locking requirements of vlan_for_each() and leaves the VLAN list unprotected from concurrent modifications.

This flaw affects specific DSA switch configurations using the felix driver as a DSA master with VLAN-aware bridging. The warning indicates a potential race condition where the VLAN list could be modified while being traversed. While primarily manifesting as a lockdep warning, the underlying race could lead to list corruption in concurrent scenarios.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.