CVE-2023-52505: phy: lynx-28g: serialize concurrent phy_set_mode_ext() calls to shared registers

Severity: medium (CVSS 4.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-03-02 · updated 2026-06-17
Weakness: CWE-667

Description

In the Linux kernel, the following vulnerability has been resolved: phy: lynx-28g: serialize concurrent phy_set_mode_ext() calls to shared registers The protocol converter configuration registers PCC8, PCCC, PCCD (implemented by the driver), as well as others, control protocol converters from multiple lanes (each represented as a different struct phy). So, if there are simultaneous calls to phy_set_mode_ext() to lanes sharing the same PCC register (either for the "old" or for the "new" protocol), corruption of the values programmed to hardware is possible, because lynx_28g_rmw() has no locking. Add a spinlock in the struct lynx_28g_priv shared by all lanes, and take the global spinlock from the phy_ops :: set_mode() implementation. There are no other callers which modify PCC registers.

Affected products

Linux kernel: from 5.18 before 6.1.59; from 6.2 before 6.5.8; 6.6-rc1, 6.6-rc2, 6.6-rc3, 6.6-rc4, 6.6-rc5 — fixed in 6.1.59, 6.5.8

How to fix

Upgrade to a fixed version: Linux kernel 6.1.59, 6.5.8. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-52505 or the next vulnerability affects your stack