In the Linux kernel, the following vulnerability has been resolved:
net: vlan: don't propagate flags on open
With the device instance lock, there is now a possibility of a deadlock:
[ 1.211455] ============================================ [ 1.211571] WARNING: possible recursive locking detected [ 1.211687] 6.14.0-rc5-01215-g032756b4ca7a-dirty #5 Not tainted [ 1.211823] -------------------------------------------- [ 1.211936] ip/184 is trying to acquire lock: [ 1.212032] ffff8881024a4c30 (&dev->lock){+.+.}-{4:4}, at: devsetallmulti+0x4e/0xb0 [ 1.212207] [ 1.212207] but task is already holding lock: [ 1.212332] ffff8881024a4c30 (&dev->lock){+.+.}-{4:4}, at: devopen+0x50/0xb0 [ 1.212487] [ 1.212487] other info that might help us debug this: [ 1.212626] Possible unsafe locking scenario: [ 1.212626] [ 1.212751] CPU0 [ 1.212815] ---- [ 1.212871] lock(&dev->lock); [ 1.212944] lock(&dev->lock); [ 1.213016] [ 1.213016] * DEADLOCK * [ 1.213016] [ 1.213143] May be due to missing lock nesting notation [ 1.213143] [ 1.213294] 3 locks held by ip/184: [ 1.213371] #0: ffffffff838b53e0 (rtnlmutex){+.+.}-{4:4}, at: rtnlnetslock+0x1b/0xa0 [ 1.213543] #1: ffffffff84e5fc70 (&net->rtnlmutex){+.+.}-{4:4}, at: rtnlnetslock+0x37/0xa0 [ 1.213727] #2: ffff8881024a4c30 (&dev->lock){+.+.}-{4:4}, at: devopen+0x50/0xb0 [ 1.213895] [ 1.213895] stack backtrace: [ 1.213991] CPU: 0 UID: 0 PID: 184 Comm: ip Not tainted 6.14.0-rc5-01215-g032756b4ca7a-dirty #5 [ 1.213993] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014 [ 1.213994] Call Trace: [ 1.213995] <TASK> [ 1.213996] dumpstacklvl+0x8e/0xd0 [ 1.214000] printdeadlockbug+0x28b/0x2a0 [ 1.214020] lockacquire+0xea/0x2a0 [ 1.214027] mutexlock+0xbf/0xd40 [ 1.214038] devsetallmulti+0x4e/0xb0 # realdev->flags & IFFALLMULTI [ 1.214040] vlandevopen+0xa5/0x170 # ndoopen on vlandev [ 1.214042] _devopen+0x145/0x270 [ 1.214046] _devchangeflags+0xb0/0x1e0 [ 1.214051] netifchangeflags+0x22/0x60 # IFFUP vlandev [ 1.214053] devchangeflags+0x61/0xb0 # for each device in group from dev->vlaninfo [ 1.214055] vlandeviceevent+0x766/0x7c0 # on netdevsim0 [ 1.214058] notifiercallchain+0x78/0x120 [ 1.214062] netifopen+0x6d/0x90 [ 1.214064] devopen+0x5b/0xb0 # locks netdevsim0 [ 1.214066] bondenslave+0x64c/0x1230 [ 1.214075] dosetmaster+0x175/0x1e0 # on netdevsim0 [ 1.214077] dosetlink+0x516/0x13b0 [ 1.214094] rtnlnewlink+0xaba/0xb80 [ 1.214132] rtnetlinkrcvmsg+0x440/0x490 [ 1.214144] netlinkrcvskb+0xeb/0x120 [ 1.214150] netlinkunicast+0x1f9/0x320 [ 1.214153] netlinksendmsg+0x346/0x3f0 [ 1.214157] _socksendmsg+0x86/0xb0 [ 1.214160] _syssendmsg+0x1c8/0x220 [ 1.214164] _syssendmsg+0x28f/0x2d0 [ 1.214179] _x64syssendmsg+0xef/0x140 [ 1.214184] dosyscall64+0xec/0x1d0 [ 1.214190] entrySYSCALL64after_hwframe+0x77/0x7f [ 1.214191] RIP: 0033:0x7f2d1b4a7e56
Device setup:
netdevsim0 (down)
^ ^
bond netdevsim1.100@netdevsim1 allmulticast=on (down)
When we enslave the lower device (netdevsim0) which has a vlan, we propagate vlan's allmuti/promisc flags during ndoopen. This causes (re)locking on of the realdev.
Propagate allmulti/promisc on flags change, not on the open. There is a slight semantics change that vlans that are down now propagate the flags, but this seems unlikely to result in the real issues.
Reproducer:
echo 0 1 > /sys/bus/netdevsim/new_device
devpath=$(ls -d /sys/bus/netdevsim/devices/netdevsim0/net/*) dev=$(echo $devpath | rev | cut -d/ -f1 | rev)
ip link set dev $dev name netdevsim0 ip link set dev netdevsim0 up
ip link add link netdevsim0 name netdevsim0.100 type vlan id 100 ip link set dev netdevsim0.100 allm ---truncated---
[
{
"id": "CVE-2025-23163-08772bb1",
"target": {
"file": "net/8021q/vlan_dev.c",
"function": "vlan_dev_stop"
},
"digest": {
"function_hash": "308123645430643740053680812937488368088",
"length": 464.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@27b918007d96402aba10ed52a6af8015230f1793",
"signature_version": "v1"
},
{
"id": "CVE-2025-23163-08d05492",
"target": {
"file": "net/8021q/vlan_dev.c",
"function": "vlan_dev_stop"
},
"digest": {
"function_hash": "308123645430643740053680812937488368088",
"length": 464.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a32f1d4f1f4c9d978698f3c718621f6198f2e7ac",
"signature_version": "v1"
},
{
"id": "CVE-2025-23163-0ea55f35",
"target": {
"file": "net/8021q/vlan_dev.c",
"function": "vlan_dev_open"
},
"digest": {
"function_hash": "247426616970289515324000921180539979233",
"length": 1098.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a32f1d4f1f4c9d978698f3c718621f6198f2e7ac",
"signature_version": "v1"
},
{
"id": "CVE-2025-23163-23877759",
"target": {
"file": "net/8021q/vlan_dev.c",
"function": "vlan_dev_change_rx_flags"
},
"digest": {
"function_hash": "53357152155860587853739518496352424665",
"length": 310.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@27b918007d96402aba10ed52a6af8015230f1793",
"signature_version": "v1"
},
{
"id": "CVE-2025-23163-34f3b296",
"target": {
"file": "net/8021q/vlan_dev.c",
"function": "vlan_dev_open"
},
"digest": {
"function_hash": "247426616970289515324000921180539979233",
"length": 1098.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@27b918007d96402aba10ed52a6af8015230f1793",
"signature_version": "v1"
},
{
"id": "CVE-2025-23163-3798beaf",
"target": {
"file": "net/8021q/vlan_dev.c",
"function": "vlan_dev_open"
},
"digest": {
"function_hash": "247426616970289515324000921180539979233",
"length": 1098.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8980018a9806743d9b80837330d46f06ecf78516",
"signature_version": "v1"
},
{
"id": "CVE-2025-23163-44860586",
"target": {
"file": "net/8021q/vlan_dev.c",
"function": "vlan_dev_open"
},
"digest": {
"function_hash": "247426616970289515324000921180539979233",
"length": 1098.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@538b43aa21e3b17c110104efd218b966d2eda5f8",
"signature_version": "v1"
},
{
"id": "CVE-2025-23163-4627bb7e",
"target": {
"file": "net/8021q/vlan_dev.c",
"function": "vlan_dev_stop"
},
"digest": {
"function_hash": "308123645430643740053680812937488368088",
"length": 464.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8980018a9806743d9b80837330d46f06ecf78516",
"signature_version": "v1"
},
{
"id": "CVE-2025-23163-46b59041",
"target": {
"file": "net/8021q/vlan_dev.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"202977026713686569346594619254076392864",
"213945912895615710942072653443753925870",
"8321467919750070853606141298071633649",
"307247168306325270240637148351554549779",
"213276168389203769379866508069206211515",
"117452877375128652072548972758637630608",
"119070445229741903804642144817893044163",
"224911885848894950180143843221443798074",
"158971499384329986806286512976383001927",
"42002240475595289390278127644602406495",
"521444748820278449043170611693715367",
"199252315002357820881548848333928176377",
"123512355877468682377585615062477744972",
"262874804273469986125821028162373446400",
"73066747409680009181979554356623038925",
"210142910325056460858627533618030161146",
"20120477447012443164987397481980006495",
"268927764250979342778585932008404351766",
"331031712829126106688903625742871795743",
"150148019105752504709430953302939075219",
"169359734446572208189121742094151350732",
"19719342486895271667297686998419546646",
"304071597025103012169610020990738146250",
"286951060427252525260741011716874537883",
"276191283407411226144669692281713377057",
"9389007403719107189720234522424981092",
"253630436237778167049619848112494850270",
"247302600996560879807768651676286027976",
"15405629329758888430862391707295496518",
"52251861132321390848230839614209106452",
"325317619898401964727548454832851221861",
"319320242436860385809827285180826229261",
"266815805467222254809005521412832394826",
"140573217983211085619168344332405241212",
"323125504653592971946609252230792571405",
"284410507706052756915324457149340569936",
"219233830693609721018191026793904637743",
"292015403769012672739930606613783732668"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a32f1d4f1f4c9d978698f3c718621f6198f2e7ac",
"signature_version": "v1"
},
{
"id": "CVE-2025-23163-53d22eb1",
"target": {
"file": "net/8021q/vlan_dev.c",
"function": "vlan_dev_change_rx_flags"
},
"digest": {
"function_hash": "53357152155860587853739518496352424665",
"length": 310.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8980018a9806743d9b80837330d46f06ecf78516",
"signature_version": "v1"
},
{
"id": "CVE-2025-23163-6163df81",
"target": {
"file": "net/8021q/vlan_dev.c",
"function": "vlan_dev_stop"
},
"digest": {
"function_hash": "308123645430643740053680812937488368088",
"length": 464.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@538b43aa21e3b17c110104efd218b966d2eda5f8",
"signature_version": "v1"
},
{
"id": "CVE-2025-23163-81060296",
"target": {
"file": "net/8021q/vlan_dev.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"202977026713686569346594619254076392864",
"213945912895615710942072653443753925870",
"8321467919750070853606141298071633649",
"307247168306325270240637148351554549779",
"213276168389203769379866508069206211515",
"117452877375128652072548972758637630608",
"119070445229741903804642144817893044163",
"224911885848894950180143843221443798074",
"158971499384329986806286512976383001927",
"42002240475595289390278127644602406495",
"521444748820278449043170611693715367",
"199252315002357820881548848333928176377",
"123512355877468682377585615062477744972",
"262874804273469986125821028162373446400",
"73066747409680009181979554356623038925",
"210142910325056460858627533618030161146",
"20120477447012443164987397481980006495",
"268927764250979342778585932008404351766",
"331031712829126106688903625742871795743",
"150148019105752504709430953302939075219",
"169359734446572208189121742094151350732",
"19719342486895271667297686998419546646",
"304071597025103012169610020990738146250",
"286951060427252525260741011716874537883",
"276191283407411226144669692281713377057",
"9389007403719107189720234522424981092",
"253630436237778167049619848112494850270",
"247302600996560879807768651676286027976",
"15405629329758888430862391707295496518",
"52251861132321390848230839614209106452",
"325317619898401964727548454832851221861",
"319320242436860385809827285180826229261",
"266815805467222254809005521412832394826",
"140573217983211085619168344332405241212",
"323125504653592971946609252230792571405",
"284410507706052756915324457149340569936",
"219233830693609721018191026793904637743",
"292015403769012672739930606613783732668"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8980018a9806743d9b80837330d46f06ecf78516",
"signature_version": "v1"
},
{
"id": "CVE-2025-23163-8c01f183",
"target": {
"file": "net/8021q/vlan_dev.c",
"function": "vlan_dev_change_rx_flags"
},
"digest": {
"function_hash": "53357152155860587853739518496352424665",
"length": 310.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@538b43aa21e3b17c110104efd218b966d2eda5f8",
"signature_version": "v1"
},
{
"id": "CVE-2025-23163-8e2fd4ac",
"target": {
"file": "net/8021q/vlan_dev.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"202977026713686569346594619254076392864",
"213945912895615710942072653443753925870",
"8321467919750070853606141298071633649",
"307247168306325270240637148351554549779",
"213276168389203769379866508069206211515",
"117452877375128652072548972758637630608",
"119070445229741903804642144817893044163",
"224911885848894950180143843221443798074",
"158971499384329986806286512976383001927",
"42002240475595289390278127644602406495",
"521444748820278449043170611693715367",
"199252315002357820881548848333928176377",
"123512355877468682377585615062477744972",
"262874804273469986125821028162373446400",
"73066747409680009181979554356623038925",
"210142910325056460858627533618030161146",
"20120477447012443164987397481980006495",
"268927764250979342778585932008404351766",
"331031712829126106688903625742871795743",
"150148019105752504709430953302939075219",
"169359734446572208189121742094151350732",
"19719342486895271667297686998419546646",
"304071597025103012169610020990738146250",
"286951060427252525260741011716874537883",
"276191283407411226144669692281713377057",
"9389007403719107189720234522424981092",
"253630436237778167049619848112494850270",
"247302600996560879807768651676286027976",
"15405629329758888430862391707295496518",
"52251861132321390848230839614209106452",
"325317619898401964727548454832851221861",
"319320242436860385809827285180826229261",
"266815805467222254809005521412832394826",
"140573217983211085619168344332405241212",
"323125504653592971946609252230792571405",
"284410507706052756915324457149340569936",
"219233830693609721018191026793904637743",
"292015403769012672739930606613783732668"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@538b43aa21e3b17c110104efd218b966d2eda5f8",
"signature_version": "v1"
},
{
"id": "CVE-2025-23163-d5816bfa",
"target": {
"file": "net/8021q/vlan_dev.c",
"function": "vlan_dev_change_rx_flags"
},
"digest": {
"function_hash": "53357152155860587853739518496352424665",
"length": 310.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a32f1d4f1f4c9d978698f3c718621f6198f2e7ac",
"signature_version": "v1"
},
{
"id": "CVE-2025-23163-eaac7714",
"target": {
"file": "net/8021q/vlan_dev.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"202977026713686569346594619254076392864",
"213945912895615710942072653443753925870",
"8321467919750070853606141298071633649",
"307247168306325270240637148351554549779",
"213276168389203769379866508069206211515",
"117452877375128652072548972758637630608",
"119070445229741903804642144817893044163",
"224911885848894950180143843221443798074",
"158971499384329986806286512976383001927",
"42002240475595289390278127644602406495",
"521444748820278449043170611693715367",
"199252315002357820881548848333928176377",
"123512355877468682377585615062477744972",
"262874804273469986125821028162373446400",
"73066747409680009181979554356623038925",
"210142910325056460858627533618030161146",
"20120477447012443164987397481980006495",
"268927764250979342778585932008404351766",
"331031712829126106688903625742871795743",
"150148019105752504709430953302939075219",
"169359734446572208189121742094151350732",
"19719342486895271667297686998419546646",
"304071597025103012169610020990738146250",
"286951060427252525260741011716874537883",
"276191283407411226144669692281713377057",
"9389007403719107189720234522424981092",
"253630436237778167049619848112494850270",
"247302600996560879807768651676286027976",
"15405629329758888430862391707295496518",
"52251861132321390848230839614209106452",
"325317619898401964727548454832851221861",
"319320242436860385809827285180826229261",
"266815805467222254809005521412832394826",
"140573217983211085619168344332405241212",
"323125504653592971946609252230792571405",
"284410507706052756915324457149340569936",
"219233830693609721018191026793904637743",
"292015403769012672739930606613783732668"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@27b918007d96402aba10ed52a6af8015230f1793",
"signature_version": "v1"
}
]