CVE-2026-46287
Estado: AnalizadaMedia (5.5)—
In the Linux kernel, the following vulnerability has been resolved:
net: txgbe: fix RTNL assertion warning when remove module
For the copper NIC with external PHY, the driver called phylink_connect_phy() during probe and phylink_disconnect_phy() during remove. It caused an RTNL assertion warning in phylink_disconnect_phy() upon module remove.
To fix this, add rtnl_lock() and rtnl_unlock() around the phylink_disconnect_phy() in remove function.
Detalles técnicos trazas, registros y código del informe original
------------[ cut here ]------------ RTNL: assertion failed at drivers/net/phy/phylink.c (2351) WARNING: drivers/net/phy/phylink.c:2351 at phylink_disconnect_phy+0xd8/0xf0 [phylink], CPU#0: rmmod/4464 Modules linked in: ... CPU: 0 UID: 0 PID: 4464 Comm: rmmod Kdump: loaded Not tainted 7.0.0-rc4+ Hardware name: Micro-Star International Co., Ltd. MS-7E16/X670E GAMING PLUS WIFI (MS-7E16), BIOS 1.90 12/31/2024 RIP: 0010:phylink_disconnect_phy+0xe4/0xf0 [phylink] Code: 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 31 d2 31 f6 31 ff e9 3a 38 8f e7 48 8d 3d 48 87 e2 ff ba 2f 09 00 00 48 c7 c6 c1 22 24 c0 <67> 48 0f b9 3a e9 34 ff ff ff 66 90 90 90 90 90 90 90 90 90 90 90 RSP: 0018:ffffce7288363ac0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff89654b2a1a00 RCX: 0000000000000000 RDX: 000000000000092f RSI: ffffffffc02422c1 RDI: ffffffffc0239020 RBP: ffffce7288363ae8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff8964c4022000 R13: ffff89654fce3028 R14: ffff89654ebb4000 R15: ffffffffc0226348 FS: 0000795e80d93780(0000) GS:ffff896c52857000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005b528b592000 CR3: 0000000170d0f000 CR4: 0000000000f50ef0 PKRU: 55555554 Call Trace: <TASK> txgbe_remove_phy+0xbb/0xd0 [txgbe] txgbe_remove+0x4c/0xb0 [txgbe] pci_device_remove+0x41/0xb0 device_remove+0x43/0x80 device_release_driver_internal+0x206/0x270 driver_detach+0x4a/0xa0 bus_remove_driver+0x83/0x120 driver_unregister+0x2f/0x60 pci_unregister_driver+0x40/0x90 txgbe_driver_exit+0x10/0x850 [txgbe] __do_sys_delete_module.isra.0+0x1c3/0x2f0 __x64_sys_delete_module+0x12/0x20 x64_sys_call+0x20c3/0x2390 do_syscall_64+0x11c/0x1500 ? srso_alias_return_thunk+0x5/0xfbef5 ? do_syscall_64+0x15a/0x1500 ? srso_alias_return_thunk+0x5/0xfbef5 ? do_fault+0x312/0x580 ? srso_alias_return_thunk+0x5/0xfbef5 ? __handle_mm_fault+0x9d5/0x1040 ? srso_alias_return_thunk+0x5/0xfbef5 ? count_memcg_events+0x101/0x1d0 ? srso_alias_return_thunk+0x5/0xfbef5 ? handle_mm_fault+0x1e8/0x2f0 ? srso_alias_return_thunk+0x5/0xfbef5 ? do_user_addr_fault+0x2f8/0x820 ? srso_alias_return_thunk+0x5/0xfbef5 ? irqentry_exit+0xb2/0x600 ? srso_alias_return_thunk+0x5/0xfbef5 ? exc_page_fault+0x92/0x1c0 entry_SYSCALL_64_after_hwframe+0x76/0x7e
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Puntuación base: 5.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.16%
- Percentil entre todas las CVEs puntuadas: 5
- Fecha de la puntuación: 5/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- CWE-617
Referencias
- https://git.kernel.org/stable/c/0305e7118451c7c363c18f8113b0d8e0077ffa4c
- https://git.kernel.org/stable/c/3e223a7fd41ce6fffdb10577df9350385262bf33
- https://git.kernel.org/stable/c/6c5ec52c68a6a442c8a159615ae092512562318a
- https://git.kernel.org/stable/c/d29cafc7e4ee9e28a150ba17e9a565ec5d881fbc
- https://git.kernel.org/stable/c/e159f05e12cc1111a3103b99375ddf0dfd0e7d63
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-46287",
"cveTags": [],
"metrics": {
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 5.5,
"attackVector": "LOCAL",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "02b2a6f91b9042552bc3aa728622bda97e3916fa",
"lessThan": "0305e7118451c7c363c18f8113b0d8e0077ffa4c",
"versionType": "git"
},
{
"status": "affected",
"version": "02b2a6f91b9042552bc3aa728622bda97e3916fa",
"lessThan": "3e223a7fd41ce6fffdb10577df9350385262bf33",
"versionType": "git"
},
{
"status": "affected",
"version": "02b2a6f91b9042552bc3aa728622bda97e3916fa",
"lessThan": "d29cafc7e4ee9e28a150ba17e9a565ec5d881fbc",
"versionType": "git"
},
{
"status": "affected",
"version": "02b2a6f91b9042552bc3aa728622bda97e3916fa",
"lessThan": "6c5ec52c68a6a442c8a159615ae092512562318a",
"versionType": "git"
},
{
"status": "affected",
"version": "02b2a6f91b9042552bc3aa728622bda97e3916fa",
"lessThan": "e159f05e12cc1111a3103b99375ddf0dfd0e7d63",
"versionType": "git"
}
],
"programFiles": [
"drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.6",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver",
"lessThanOrEqual": "7.0.*"
},
{
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-06-08T17:16:46.770",
"references": [
{
"url": "https://git.kernel.org/stable/c/0305e7118451c7c363c18f8113b0d8e0077ffa4c",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/3e223a7fd41ce6fffdb10577df9350385262bf33",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6c5ec52c68a6a442c8a159615ae092512562318a",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d29cafc7e4ee9e28a150ba17e9a565ec5d881fbc",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e159f05e12cc1111a3103b99375ddf0dfd0e7d63",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-617"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: txgbe: fix RTNL assertion warning when remove module\n\nFor the copper NIC with external PHY, the driver called\nphylink_connect_phy() during probe and phylink_disconnect_phy() during\nremove. It caused an RTNL assertion warning in phylink_disconnect_phy()\nupon module remove.\n\nTo fix this, add rtnl_lock() and rtnl_unlock() around the\nphylink_disconnect_phy() in remove function.\n\n ------------[ cut here ]------------\n RTNL: assertion failed at drivers/net/phy/phylink.c (2351)\n WARNING: drivers/net/phy/phylink.c:2351 at\nphylink_disconnect_phy+0xd8/0xf0 [phylink], CPU#0: rmmod/4464\n Modules linked in: ...\n CPU: 0 UID: 0 PID: 4464 Comm: rmmod Kdump: loaded Not tainted 7.0.0-rc4+\n Hardware name: Micro-Star International Co., Ltd. MS-7E16/X670E GAMING\nPLUS WIFI (MS-7E16), BIOS 1.90 12/31/2024\n RIP: 0010:phylink_disconnect_phy+0xe4/0xf0 [phylink]\n Code: 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 31 d2 31 f6 31 ff e9 3a 38 8f e7\n48 8d 3d 48 87 e2 ff ba 2f 09 00 00 48 c7 c6 c1 22 24 c0 <67> 48 0f b9 3a\ne9 34 ff ff ff 66 90 90 90 90 90 90 90 90 90 90 90\n RSP: 0018:ffffce7288363ac0 EFLAGS: 00010246\n RAX: 0000000000000000 RBX: ffff89654b2a1a00 RCX: 0000000000000000\n RDX: 000000000000092f RSI: ffffffffc02422c1 RDI: ffffffffc0239020\n RBP: ffffce7288363ae8 R08: 0000000000000000 R09: 0000000000000000\n R10: 0000000000000000 R11: 0000000000000000 R12: ffff8964c4022000\n R13: ffff89654fce3028 R14: ffff89654ebb4000 R15: ffffffffc0226348\n FS: 0000795e80d93780(0000) GS:ffff896c52857000(0000)\nknlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00005b528b592000 CR3: 0000000170d0f000 CR4: 0000000000f50ef0\n PKRU: 55555554\n Call Trace:\n <TASK>\n txgbe_remove_phy+0xbb/0xd0 [txgbe]\n txgbe_remove+0x4c/0xb0 [txgbe]\n pci_device_remove+0x41/0xb0\n device_remove+0x43/0x80\n device_release_driver_internal+0x206/0x270\n driver_detach+0x4a/0xa0\n bus_remove_driver+0x83/0x120\n driver_unregister+0x2f/0x60\n pci_unregister_driver+0x40/0x90\n txgbe_driver_exit+0x10/0x850 [txgbe]\n __do_sys_delete_module.isra.0+0x1c3/0x2f0\n __x64_sys_delete_module+0x12/0x20\n x64_sys_call+0x20c3/0x2390\n do_syscall_64+0x11c/0x1500\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? do_syscall_64+0x15a/0x1500\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? do_fault+0x312/0x580\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __handle_mm_fault+0x9d5/0x1040\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? count_memcg_events+0x101/0x1d0\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? handle_mm_fault+0x1e8/0x2f0\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? do_user_addr_fault+0x2f8/0x820\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? irqentry_exit+0xb2/0x600\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? exc_page_fault+0x92/0x1c0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e"
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet: txgbe: corrige la advertencia de aserción RTNL al eliminar el módulo\n\nPara la NIC de cobre con PHY externo, el controlador llamó a\nphylink_connect_phy() durante la sonda y phylink_disconnect_phy() durante\nla eliminación. Esto causó una advertencia de aserción RTNL en phylink_disconnect_phy()\nal eliminar el módulo.\n\nPara solucionar esto, añada rtnl_lock() y rtnl_unlock() alrededor de\nphylink_disconnect_phy() en la función de eliminación.\n\n ------------[ cortar aquí ]------------\n RTNL: aserción fallida en drivers/net/phy/phylink.c (2351)\n ADVERTENCIA: drivers/net/phy/phylink.c:2351 en\nphylink_disconnect_phy+0xd8/0xf0 [phylink], CPU#0: rmmod/4464\n Módulos enlazados: ...\n CPU: 0 UID: 0 PID: 4464 Comm: rmmod Kdump: cargado No contaminado 7.0.0-rc4+\n Nombre del hardware: Micro-Star International Co., Ltd. MS-7E16/X670E GAMING\nPLUS WIFI (MS-7E16), BIOS 1.90 12/31/2024\n RIP: 0010:phylink_disconnect_phy+0xe4/0xf0 [phylink]\n Código: 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 31 d2 31 f6 31 ff e9 3a 38 8f e7\n48 8d 3d 48 87 e2 ff ba 2f 09 00 00 48 c7 c6 c1 22 24 c0 <67> 48 0f b9 3a\ne9 34 ff ff ff 66 90 90 90 90 90 90 90 90 90 90 90\n RSP: 0018:ffffce7288363ac0 EFLAGS: 00010246\n RAX: 0000000000000000 RBX: ffff89654b2a1a00 RCX: 0000000000000000\n RDX: 000000000000092f RSI: ffffffffc02422c1 RDI: ffffffffc0239020\n RBP: ffffce7288363ae8 R08: 0000000000000000 R09: 0000000000000000\n R10: 0000000000000000 R11: 0000000000000000 R12: ffff8964c4022000\n R13: ffff89654fce3028 R14: ffff89654ebb4000 R15: ffffffffc0226348\n FS: 0000795e80d93780(0000) GS:ffff896c52857000(0000)\nknlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00005b528b592000 CR3: 0000000170d0f000 CR4: 0000000000f50ef0\n PKRU: 55555554\n Rastro de llamadas:\n <TAREA>\n txgbe_remove_phy+0xbb/0xd0 [txgbe]\n txgbe_remove+0x4c/0xb0 [txgbe]\n pci_device_remove+0x41/0xb0\n device_remove+0x43/0x80\n device_release_driver_internal+0x206/0x270\n driver_detach+0x4a/0xa0\n bus_remove_driver+0x83/0x120\n driver_unregister+0x2f/0x60\n pci_unregister_driver+0x40/0x90\n txgbe_driver_exit+0x10/0x850 [txgbe]\n __do_sys_delete_module.isra.0+0x1c3/0x2f0\n __x64_sys_delete_module+0x12/0x20\n x64_sys_call+0x20c3/0x2390\n do_syscall_64+0x11c/0x1500\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? do_syscall_64+0x15a/0x1500\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? do_fault+0x312/0x580\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __handle_mm_fault+0x9d5/0x1040\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? count_memcg_events+0x101/0x1d0\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? handle_mm_fault+0x1e8/0x2f0\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? do_user_addr_fault+0x2f8/0x820\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? irqentry_exit+0xb2/0x600\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? exc_page_fault+0x92/0x1c0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e"
}
],
"lastModified": "2026-07-25T11:10:00.100",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C002EFE2-D23C-430B-ACB7-0A4317429511",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "6.6"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5AFBE0EC-CCDF-4207-AE92-ABF958125CA4",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "6.7"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A10AC84F-C058-47D5-85B4-E6E51A613B74",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "6.13"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CDB78D6D-22C3-4154-B0D0-94AF1CE5C2E3",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "6.19"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}