CVE-2026-45849 net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj()

What is CVE-2026-45849?

CVE-2026-45849 is a medium-severity vulnerability in Linux kernel, published on 27 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj()

ocelot_port_xmit_inj() calls ocelot_can_inject() and ocelot_port_inject_frame() without holding the injection group lock. Both functions contain lockdep_assert_held() for the injection lock, and the correct caller felix_port_deferred_xmit() properly acquires the lock using ocelot_lock_inj_grp() before calling these functions.

Add ocelot_lock_inj_grp()/ocelot_unlock_inj_grp() around the register injection path to fix the missing lock protection. The FDMA path is not affected as it uses its own locking mechanism.

Weakness: CWE-667

Which versions are affected by CVE-2026-45849?

It affects 1 product.

Products include Linux kernel.

How do I fix CVE-2026-45849?

Apply the vendor's patch.

Is CVE-2026-45849 being exploited?

There is no known exploitation of CVE-2026-45849 in the wild and no public exploit code.

Other vulnerabilities in Linux kernel

• CVE-2026-53266 Linux Kernel Out-of-Bounds Write Exploited High 8.8
• CVE-2013-6282 Linux Kernel Improper Input Validation Exploited High 8.8
• CVE-2022-0185 Linux Kernel Heap-Based Buffer Overflow Exploited High 8.4
• CVE-2013-2094 Linux Kernel Privilege Escalation Exploited High 8.4
• CVE-2026-53362 Linux Kernel Unspecified Exploited High 7.8

All Linux kernel vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BELL-CVE-2026-45849, DEBIAN-CVE-2026-45849, GHSA-v32h-7447-3j7r, ROOT-OS-UBUNTU-2404-CVE-2026-45849, UBUNTU-CVE-2026-45849.