---
id: CVE-2026-43468
title: 'net/mlx5: Fix deadlock between devlink lock and esw->wq'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net/mlx5: Fix deadlock between devlink lock and esw->wq

  esw->work_queue executes esw_functions_changed_event_handler ->
  esw_vfs_changed_event_handler and acquires the …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= f1bc646c9a06f09aad5d8bacb87103b5573ee45e <
    0de867f6e34eae6907b367fd152c55e61cb98608
  - >-
    Linux >= f1bc646c9a06f09aad5d8bacb87103b5573ee45e <
    957d2a58f7f8ebcbdd0a85935e0d2675134b890d
  - >-
    Linux >= f1bc646c9a06f09aad5d8bacb87103b5573ee45e <
    3c7313cb41b1b427078440364d2f042c276a1c0b
  - >-
    Linux >= f1bc646c9a06f09aad5d8bacb87103b5573ee45e <
    4a7838bebc38374f74baaf88bf2cf8d439a92923
  - >-
    Linux >= f1bc646c9a06f09aad5d8bacb87103b5573ee45e <
    90e7e5d14d0bd25ffd019a3aa39d9f1c05fedbe1
  - >-
    Linux >= f1bc646c9a06f09aad5d8bacb87103b5573ee45e <
    aed763abf0e905b4b8d747d1ba9e172961572f57
  - Linux 6.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T15:39:31.294796Z'
published: '2026-05-08'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T15:42:56.033Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-43468'
references:
  - url: 'https://git.kernel.org/stable/c/0de867f6e34eae6907b367fd152c55e61cb98608'
  - url: 'https://git.kernel.org/stable/c/957d2a58f7f8ebcbdd0a85935e0d2675134b890d'
  - url: 'https://git.kernel.org/stable/c/3c7313cb41b1b427078440364d2f042c276a1c0b'
  - url: 'https://git.kernel.org/stable/c/4a7838bebc38374f74baaf88bf2cf8d439a92923'
  - url: 'https://git.kernel.org/stable/c/90e7e5d14d0bd25ffd019a3aa39d9f1c05fedbe1'
  - url: 'https://git.kernel.org/stable/c/aed763abf0e905b4b8d747d1ba9e172961572f57'
tags:
  - cve.org
epss: 0.00091
epssPercentile: 0.00461
ingestedAt: '2026-11-06T15:54:03.906Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: Fix deadlock between devlink lock and esw->wq

esw->work_queue executes esw_functions_changed_event_handler ->
esw_vfs_changed_event_handler and acquires the devlink lock.

.eswitch_mode_set (acquires devlink lock in devlink_nl_pre_doit) ->
mlx5_devlink_eswitch_mode_set -> mlx5_eswitch_disable_locked ->
mlx5_eswitch_event_handler_unregister -> flush_workqueue deadlocks
when esw_vfs_changed_event_handler executes.

Fix that by no longer flushing the work to avoid the deadlock, and using
a generation counter to keep track of work relevance. This avoids an old
handler manipulating an esw that has undergone one or more mode changes:
- the counter is incremented in mlx5_eswitch_event_handler_unregister.
- the counter is read and passed to the ephemeral mlx5_host_work struct.
- the work handler takes the devlink lock and bails out if the current
  generation is different than the one it was scheduled to operate on.
- mlx5_eswitch_cleanup does the final draining before destroying the wq.

No longer flushing the workqueue has the side effect of maybe no longer
cancelling pending vport_change_handler work items, but that's ok since
those are disabled elsewhere:
- mlx5_eswitch_disable_locked disables the vport eq notifier.
- mlx5_esw_vport_disable disarms the HW EQ notification and marks
  vport->enabled under state_lock to false to prevent pending vport
  handler from doing anything.
- mlx5_eswitch_cleanup destroys the workqueue and makes sure all events
  are disabled/finished.

## Affected

- `Linux >= f1bc646c9a06f09aad5d8bacb87103b5573ee45e < 0de867f6e34eae6907b367fd152c55e61cb98608`
- `Linux >= f1bc646c9a06f09aad5d8bacb87103b5573ee45e < 957d2a58f7f8ebcbdd0a85935e0d2675134b890d`
- `Linux >= f1bc646c9a06f09aad5d8bacb87103b5573ee45e < 3c7313cb41b1b427078440364d2f042c276a1c0b`
- `Linux >= f1bc646c9a06f09aad5d8bacb87103b5573ee45e < 4a7838bebc38374f74baaf88bf2cf8d439a92923`
- `Linux >= f1bc646c9a06f09aad5d8bacb87103b5573ee45e < 90e7e5d14d0bd25ffd019a3aa39d9f1c05fedbe1`
- `Linux >= f1bc646c9a06f09aad5d8bacb87103b5573ee45e < aed763abf0e905b4b8d747d1ba9e172961572f57`
- `Linux 6.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.