CVE-2026-45907

A flaw was found in the Linux kernel's mlx5e network driver. Incorrect lock ordering between devlink and netdev instance locks can lead to deadlocks. This issue can be triggered during various work tasks related to devlink health reporter recovery or concurrent channel tear down. A local attacker or specific network conditions could potentially exploit this to cause a Denial of Service (DoS) by making the system unresponsive.

This vulnerability is rated as having Moderate impact for Red Hat products because it only affects environments utilizing Mellanox hardware where error recovery routines or interface teardowns occur, resulting in a denial-of-service condition without compromising data confidentiality or system integrity. The issue stems from an inverted synchronization lock sequence in the mlx5 network driver during health reporting tasks, which can freeze kernel execution threads. Deployments lacking Mellanox network adapters or running kernels without this specific driver implementation remain unaffected by the locking conflict.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.