In the Linux kernel, the following vulnerability has been resolved:
phy: lynx-28g: serialize concurrent physetmode_ext() calls to shared registers
The protocol converter configuration registers PCC8, PCCC, PCCD (implemented by the driver), as well as others, control protocol converters from multiple lanes (each represented as a different struct phy). So, if there are simultaneous calls to physetmodeext() to lanes sharing the same PCC register (either for the "old" or for the "new" protocol), corruption of the values programmed to hardware is possible, because lynx28g_rmw() has no locking.
Add a spinlock in the struct lynx28gpriv shared by all lanes, and take the global spinlock from the phyops :: setmode() implementation. There are no other callers which modify PCC registers.